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Terror Operations: Case Studies in Terror 
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e Adds one case study on the “Beslan: Hostage Crisis and Mass Murder” as chapter 6. 
e Adds bibliographical references to support Chapter 6. 


e Adds source notes to support images in Chapter 6. 
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Preface 


Terror Operations: Case Studies in Terrorism is a supplemental handbook that presents 
several terrorist incidents in a case study methodology. This handbook supports a U.S. Army 
Training and Doctrine Command, TRADOC G2 capstone reference guide on terrorism, 
TRADOC G2 Handbook No. 1, A Military Guide to Terrorism in the Twenty-First Century. 
Both the capstone guide and supplemental handbook are prepared under the direction of the 
TRADOC G2, TRADOC Intelligence Support Activity-Threats. Understanding terrorism 
spans foreign and domestic threats of nation-states, rogue states with international or 
transnational agent demonstrations, and extremist cells with members or loosely affiliated 
actors with specific strategies, tactics, and targets. A central aspect of this handbook 
comprises foreign and domestic threats against the United States of America in a contemporary 
operational environment (COE). 


Purpose. This informational handbook supports institutional training, professional military 
education, and operational missions for U.S. military forces in the War on Terrorism (WOT). 
This document provides an introduction to the nature of terrorism and recognition of terrorist 
threats to U.S. military forces. A common situational awareness by U.S. military forces 
considers three principal venues for armed forces: forces that are deployed, forces that are in- 
transit to or from an operational mission, and forces that are primarily installation or 
institution support. Compiled from open source materials, this handbook promotes a “Threats” 
perspective and enemy situational awareness of U.S. strategies and operations in combating 
terrorism. Neither a counterterrorism directive nor antiterrorism manual, this handbook 
complements but does not replace Army training and intelligence products on terrorism. 


Intended Audience. This handbook exists primarily for U.S. military forces; however, other 
applicable groups include interdepartmental, interagency, intergovernmental, civilian 
contractor, nongovernmental, private volunteer, and humanitarian relief organizations, and the 
general citizenry. 


Handbook Use. Study of contemporary terrorist motivations and behavior, terrorist goals 
and objectives, and knowledge of terrorist tactics, techniques, and procedures (TTP) improve 
training and readiness of U.S. military forces. This handbook will be updated as necessary to 
enhance a current and relevant resource. A selected bibliography presents citations for 
detailed study of specific terrorism topics. Unless stated otherwise, masculine nouns or 
pronouns do not refer exclusively to men. 


Proponent Statement. Headquarters, U.S. Army Training and Doctrine Command (TRADOC) 
is the proponent for this publication. Periodic updates will accommodate emergent user 
requirements on terrorism. Send comments and recommendations on DA Form 2028 directly to 
Director, U.S. Army TRADOC Intelligence Support Activity (TRISA)-Threats, ATTN: ATIN-T, 
Threats Terrorism Team, Bldg 53, 700 Scott Avenue, Fort Leavenworth, Kansas 66027-1323. 


This handbook is available at https://dcsint-threats.leavenworth.army.mil. and requires an Army 
Knowledge Online (AKO) login for access. 
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Terror Operations: Case Studies in Terrorism 


Introduction 


..-War has been waged on us [USA] by stealth and deceit 
and murder. This nation is peaceful, but fierce when stirred 
to anger. The conflict has begun on the timing and terms of 
others. It will end in a way, and at an hour, of our choosing. 


George W. Bush 
The President of the United States of America 
September 14, 2001 


This supplemental handbook presents a sampling of foreign and domestic terrorist incidents 
against the United States of America. Using an abridged case study methodology, analysis 
approaches each case from a “Threats” adversary viewpoint. Assessment provides 
observations on terrorist effectiveness in a contemporary operational environment. 


The Contemporary Operational Environment (COE) has several common threads or constants 
for defining the environment. The U.S. will not experience a peer competitor until 2020 or 
beyond. Armed forces will continue to be used as a tool to pursue national interests. The U.S. 
may direct military action within the context of an alliance, a coalition, or even as unilateral 
action, with or without United Nations sanctions. Actions will be waged in a larger 
environment of diplomatic, informational, economic, and military operations. Modernization 
of capabilities by potential or known adversaries could negate U.S. overmatch for select 
periods of time or specific capabilities. Similarly, advanced technologies will be readily 
available on a world market for nation-states and non-state actors. Non-state actors can cause 
significant impacts on a military operation, as combatants and non-combatants. Of course, 
these factors and their effects will vary depending on a particular situation; however, a 
constant that must also be addressed is the issue of variables. To recognize the conditions, 
circumstances, and influences that effect employment of terrorist acts, analysis includes 
constants [factors] of the Operational Environment (OE), as well as critical variables that 
define a specific operational situation.’ 


To understand the complex interactions of the Operational Environment, a framework of 
“systems” assists in assessing and gaining situational awareness. Joint doctrine uses systems 
of Political, Military, Economic, Social, Infrastructure, and Information (PMESII) to shape 
and conduct missions. PMESII, with other variables such as physical environment and time, 
affect circumstances and influence operations throughout the domains of air, land, sea, and 
space. This broader perspective, combined with mission, enemy and belligerents, friendly 
forces and partners, cultural sensitivities and resolve, are critical to mission success. Defining 
physical environmental conditions include terrain or urban settings (super-surface, surface and 


' Field Manual [U.S. Army] 7-100, Opposing Force Doctrinal Framework and Strategy, Headquarters, 
Department of the Army, iv to x, xvi (Washington, D.C., 2003). See discussion of DOD operating environment 
and Army description on contemporary operational environment (COE) “constants” and “critical variables.” 
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subsurface features), weather, topography, and hydrology. The variable of time influences 
action such as planning, multi-echelon decision cycles, tempo of operations, and projected 
pacing of popular support for operations. Whether a real world threat or an opposing force 
created to simulate relevant conditions for training readiness, PMESII and other variables 
such as physical environment and time (PMESII+PT) describe the OE. 


Interaction among these elements may range from 
peaceful humanitarian assistance to high-intensity 


combat operations. Alliances and coalitions are the PMESII and 
expectation in most operations, but U.S. unilateral action Other Variables 
is always a consideration. Military operations interrelate maralical 

with other elements of national power — diplomatic, Aviines 

economic, social-cultural, and informational — for both y 

the U.S. and an adversary. Advanced technologies are * Economic 

available to almost anyone, yet sophistication of weapon * Social 

systems, in itself, may be a liability. Intelligence and ¢ Information 
operational tools must overlap and integrate complex ¢ Infrastructure 
sensor-surveillance systems and the value of human - 


Physical Environment 


intelligence “eyes on the ground” collection and analysis. aime 


Engagement among actors in the COE can span formal 
nation-state representatives to the impact of individual 
combatants and noncombatants. Acts of terrorism are 
part of this reality. 


Using open source material, this case study series provides an appreciation of how much 
information is readily available to friend and foe in understanding the tactics, techniques, and 
procedures of a terrorist operation. Combined with situational awareness, U.S. military forces 
can better deter, dissuade, or deny terrorists in the ability to achieve terrorist acts and aims. 
Simultaneously, U.S. military forces maintain the ability to better defend and protect the 
United States, its people, and interests in the Homeland and abroad throughout a full spectrum 
of operations and contingencies. 


The U.S. is conducting a War on Terrorism (WOT). This national strategy is offensive, 
direct, and continuous.” U.S. action will initially disrupt, over time degrade, and ultimately 
destroy terrorist organizations of global reach.” Targets of U.S. operations will include 
terrorist leaders; their command, control, and communications; material support; and their 
finances. The war on terrorism will be fought on many fronts against a particularly elusive 
enemy over an extended period of time. 


Case Study Purpose 


Know your enemy. This can be a two-edged sword of situational awareness and 
understanding. Through discerning threats and capabilities with documented terrorist 


* The White House, The National Security Strategy of the United Sates of America, Section III and IX, 17 
September 2002; available at http://www.whitehouse.gov/nsc/nss.html; Internet; accessed 30 April 2004. 
> The White House, National Strategy for Combating Terrorism, 2, February 2003; available at 
http://www.state.gov/s/ct/rls/rm/2003/17798.htm; Internet; accessed 30 April 2004. 
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incidents, U.S. military leaders will develop better situational awareness of forces and vectors 
of terrorism. 


Case Study Elements 


Case study method is a process of shared responsibility and disciplined exploration. In this 
terrorism handbook, case study organization comprises three main elements of (1) a case 
study abstract; (2) a main body comprising an introduction, learning objectives, situational 
overview, focus areas, case study discussion questions, and a brief case assessment; and (3) a 
bibliography of selected open-source references per terrorist incident. The references are a 
prompt to seek additional resources through multi-media research and study. 


Case study is an effective adult learning method that “...provides an opportunity to gain 
confidence in one’s own judgment, but also a degree of humility as well. It also provides a 
most invaluable opportunity to learn how far one can go by rigorous logical analyses of one of 
the other dimensions of the problem and the extent to which judgment comes into play when 
many factors which have no common denominator must be weighed.”* 


This process guides, but does not dictate, a learning outcome. Using the case method, every 
iteration “...provides opportunity for new intellectual adventure, for risk taking, for new 
learning. One may have taught [studied] the case before, but last year’s notes have limited 
current value. With a new group of students [leaders], the unfolding dynamic of a unique 
section, and different time circumstances, familiar material is revitalized.”” 


Interaction among individuals can involve different techniques to compare and contrast 
analysis and synthesis of case study material. After an initial reading of the case study, 
options include focusing each student on one specific aspect of the incident and requiring an 
appraisal, creating two-person groups to identify key issues for the larger group study, using small 
groups to be advocates on a particular aspect of motivation, behavior, or outcome in an incident, or 
direct a simple free-writing exercise to suggest student topics for further investigation.° 


Closure of a case study is based on a premise that most case studies do not have an endpoint 
answer or a Salient solution. The norm should be a confirmation of what new understanding 
and awareness exists from case study, what actions may be appropriate in the immediate 
future, and what additional questions have been identified as a continuum of investigation 
and refinement .” 


Abstract. A brief statement summarizes the case study and its significant observations on 
foreign or domestic terrorism. 


“ Louis B. Bares, C. Roland Christensen, and Abby J. Hansen. Teaching and the Case Method. (Boston: 
Harvard Business School Press, 1994), 41. 

* Thid., 42. 

° Raymond J. Wlodkowski, Enhancing Adult Motivation to Learn, (San Francisoco: Jossey-Bass Publishers, 
1999), 228. 

"Tbid., 230. 
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Introduction. A preface presents the principal contents and purpose of the case study. 
Providing background information, the introduction provides context to the incident and 
enhances an appreciation of the sequence of events and act of terrorism. 


Case Methodology 

The case study presents, analyzes, and assesses salient aspects of a terrorism incident. This 
method evolves from an overarching study of selected terrorism characteristics, specified 
learning objectives, case questions which focus analysis, and a summarized assessment of the 
analysis for discussion. Research data comes from unclassified sources and is available from 


common open-source portals. 


Learning Objectives. The group of intended outcomes from the case study enables focused 
study, discussion, and analysis of a specific terrorist incident. 


Case Questions. Issues, stated as open-ended questions, propose primary study topics. 
These queries explore relationships of terrorist tactics, techniques and procedures (TTP), and 
how terrorist capabilities were implemented to achieve a terrorist objective. 

Assessment. Cogent statements summarize deliberate analyses of causal factors or linked 
relationships in a specified act of terrorism, and present informed conclusions to optimize 
planning and actions against terrorism capabilities. 

Case Studies Index 

e Tokyo Chemical Sarin Attack, Tokyo, Japan (1995) 

e Murrah Federal Building, Oklahoma City, Oklahoma, USA (1995) 

e Khobar Towers, Dhahran, Saudi Arabia (1996) 

e USS Cole, Aden Harbor, Yemen (2000) 

e London Bombings of 7 July 2005 (2005) 


e Beslan: Hostage Crisis and Mass Murder (2004) 


The Contemporary Operational Environment 


The War on Terrorism (WOT) is an operational environment of today and for the foreseeable 
future. The Operational Environment (OE) as defined by the Department of Defense is: “A 
composite of the conditions, circumstances, and influences that affect employment of military 
forces and bear on the decisions of the unit commander.”® The U.S. Army builds on this 


® Department of Defense, DOD Dictionary of Military Terms, available from 
http://www.dtic.mil/doctrine/jel/doddict/data/o/03843.html; Internet; accessed 24 July 2006. 
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DOD definition and further defines a mission setting for the current or near-term future 
circumstances — a Contemporary Operational Environment.” 


The Contemporary Operational Environment (COE) encompasses a full range of terrorism 
threat. Originated to address known and potential conditions and adversaries that U.S. forces 
might confront in a post-Cold War world, the COE is a 
conceptual construct to recognize several norms and critical 


Challenging Threats variables for military decisionmaking, planning, and operating. 
As a superpower, the U.S. must still consider the normal 

e Traditional influences of movements and regional powers around the world 

e Irregular and the capabilities of their armed forces, paramilitary forces, or 

© Catastrophic clandestine groups. 

e Disruptive 


The U.S. National Defense Strategy identifies four types of 
challenging threats. Traditional challenges exist by states that 
employ recognized military capabilities and forces in the more 
conventional forms of military competition and conflict. Irregular challenges are the more 
unconventional ways and means to counter the traditional advantages of much stronger opponents. 
Catastrophic challenges involve the acquisition, possession, and possible use of WMD or methods 
that produce WMD-like effects (WMD). Disruptive challenges may be the use of breakthrough 
technologies to limit or negate the operational advantage of an opponent.'” 


The National Military Strategic Plan for the War on Terrorism (NMSP-WOT) addresses the WOT 
nature of the threat, and states priorities and responsibilities within the U.S. Armed Forces. As noted 
by the U.S. Chairman of the Joint Chiefs of Staff, this 
strategy “...produces a clearer understanding of the 
enemies we face and the conditions under which we 
fight...” The nature of this environment is a war against 
extremists that advocate the use of violence to gain control 
over others, and in doing so, threaten our [U.S.] way of life. 


Terrorist Vulnerabilities 


. Le ceicae SUpBUR Success will rely heavily on close cooperation and 
: Peadersup .. integration of all instruments of national power and the 
¢ “Foot Soldiers combined efforts of the international community. The 
e Safe Havens overall goal of this war is to preserve and promote the way 
e Weapons of life of free and open societies based on rule of law, defeat 
e Funds terrorist extremism as a threat to that way of life, and create 
e Communications a global environment inhospitable to terrorist extremists."* 
and Movement 
e Access to Targets The United States will target eight major terrorist 
vulnerabilities. This targeting is against terrorists, their 
Source: National Defense Strategy, enablers, and their organizations and _ networks, 
March 2005 


including state and non-state supporters. The 
contemporary operational environment can be assessed 


* Army Field Manual 7-100, Opposing Force Doctrinal Framework and Strategy, (Washington, D.C.: GPO, 
May 2003), Foreword and iv. 

'° The National Defense Strategy of the United States of America, 1 March 2005, 2. 

" Joint Chiefs of Staff, Js War on Terrorism, Strategic Planning Division, Briefing (U) The National Military 
Strategic Plan for the War on Terrorism (NMSP-WOT), Version 18 April 2005. 
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as “...the most dangerous times of our lifetime...not so much because we know precisely 
what somebody’s going to do, when and where, or how they’re going to do it; but that we 
know their intent and we know what the possibilities are and we know what our 
vulnerabilities are...So terrorism is part of the tactic. In other ways it’s [terrorism] an 
‘ism’, much like communism and the others, only so much as it’s embodied in whatever 
movements and for whatever reasons.”'* The intent is to maintain the initiative and dictate the tempo, 
timing, and direction of military operations. 


As an example, denying resources to terrorists and 
terrorist networks is critical to countering the 
ideological support of terrorism. These efforts remove 
any legitimacy to terrorism and eliminate state and 
private support for terrorism; make it politically 


Assessing the Threat 


unsustainable for any country to support or condone i SEDI ne nneae 
terrorism; and support models for moderation in the . Analyzing Networks 
Muslim regions of the world. Techniques in is Planning Actions ; 
coordinating such actions may include a methodology e Determining Metrics 
of identifying or “mapping” key components that affect e Tracking Actions 
resources such as technology, key figures, and locations. e Evaluating Outcomes 
Identifying the major connections among these e Adapting Methods 
components can spotlight weak assailable links of the e Improving Results 


networking and where targeting and action plans may 
be most effective. Measuring results and adapting 
operations enable a process for improved Joint leader 
education, readiness training, and WOT operations.” 


Red Teaming 


As a time-proven concept used in U.S. government and commercial enterprises, “red teaming” 
deepens the understanding of options that are available to counter adaptive adversaries. This 
methodology both complements and informs intelligence collection and analysis, and enhances 
predictive estimates of adversary capabilities and intentions. Analyses of friendly forces; 
partners, allies, or neutral forces in an operational environment; and adversary capabilities and 
limitations are elements of a comprehensive decision support process. Aggressive “red 
teams,” embedded in friendly force organizations, challenge emerging operational concepts, 
evolving contingency plans, as well as operational orders in order to discover weaknesses 
before real adversaries do. The perspective of an adversary may be that of a confirmed threat, 
or a contingency of threat capabilities used to present conditions, circumstances, and 
influences for training and readiness. Focusing effects to achieve friendly force commander 
mission and intent uses red teaming to combat terrorism threats in a systematic, proactive command 
and staff decisionmaking process. 


' General Peter Schoomaker, U.S. Army Chief of Staff, “Media Roundtable at the Association of the United 
States Army Annual Convention, Washington, D.C., 4 October 2004; available from: 
http://www.army.mil/leaders/leaders/csa/interviews/04Oct04Roundtable.html; Internet; accessed 11 January 2005. 
'S Joint Chiefs of Staff, JS War on Terrorism, Strategic Planning Division, Briefing (U) Countering Ideological 
Support for Terrorism, Version 19Jan05, 5 April 2005. 
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In 2003, a Defense Science Board task force validated two primary reasons for expanding the 
role of red teaming in the DOD: (1) To deepen understanding of the adversaries the U.S. now 
faces in the war on terrorism and in particular their capabilities and potential responses to U.S. 
initiatives, and (2) To guard against complacency. Red teaming can stress concepts, plans, and 
systems to identify vulnerabilities and capabilities before direct confrontation with a real 
world adversary. 


To best apply red teaming programs, red team members must be able to understand the 
thinking and motivations of adversaries with different cultural and social backgrounds, to 
assess and analyze acting as 
independent and adaptive adversaries, 
and to interact and recommend in 
constructive and creative ways with 


the supported friendly forces leader os , : 
and military decisionmaker."4 The Threat - Any specific foreign nation or 
world today is complex, as is armed organization with intentions and military 


conflict. A significant difference capabilities that suggest it could become an 


today, different from previous recent adversary or challenge the national security 
wars, is the reality of a protracted interests of the United States or its allies. 


conflict of uncertain duration’? — a 
war on terrorism. To “detect, deter, U.S. Army Regulation 350-2 
and destroy terrorist organizations at 
every tum,” another evolving Opposing Force (OPFOR) — A plausible, 


Threat and Opposing Force 


component of any U.S. action plan is flexible military and/or paramilitary force 
to act against threats before they are representing a composite of varying cap- 
fully formed. The ability to “red abilities of actual worldwide forces, used 
team” terrorist capabilities and in lieu of a specific threat force, for 
limitations can be a powerful tool to training and developing U.S. forces. 
understand risks and identify friendly 

forces options. U.S. Army Regulation 350-2 


The overarching aim of __ this 

handbook is to create situational awareness and understanding of current terrorism 
capabilities and limitations, and complement the deliberate processes of military risk 
management, force protection, and mission orders conduct and leader decision-making. U.S. 
Armed Forces are at war — a War on Terrorism. In this long-term war of uncertain 
duration, the United States of America will continue to defend its values, liberties, and 
culture; its economic prosperity; and its security, along with allies and international partners. 


‘4 Department of Defense, Defense Science Board, Defense Science Board Task Force on The Role and Status of 
DoD Red Teaming Activities, (Washington, D.C.: Office of the Under Secretary of Defense for Acquisition, 
Technology, and Logistics, September 2003), 1, 15, 16, and Appendix 1. 

15 Cofer Black, “The International Terrorism Threat,” Testimony before the House International Relations 
committee, Subcommitteee on International Terrorism, Nonproliferation, and Human Rights, Washington, D.C., 
26 March 2003; 6, available from http://www.state.gov/s/ct/rls/rm/2003/19136.htm; Internet; accessed 21 April 
2005. 
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Chapter 1: Tokyo Subway Sarin Attack 


The March 20, 1995 chemical nerve agent attack with sarin on the population of Tokyo 
provides several significant and peculiar insights of terrorism and the use of weapons of mass 
destruction (WMD). The rush-hour attack was nearly simultaneous in execution on five 
subway trains that were converging to the center of Tokyo. This deliberate act of terrorism, 
conducted by a cult, intended to cause thousands of casualties with a chemical nerve agent. 


5" 


ig Tokyo Subway Metropolitan Network | 


eS 


Shoko Asahara 


Pus hl 
‘ 


Metro Network 


Figure 1-1. Above. Tokyo Subway Metropolitan Network Map 
(Source: map http://www.bento.com/subtop.html ) 

Figure 1-2. Above, Left. Triage Near Subway 

(Source: http://usinfo.state.gov/products/pubs/humantoll/htimages/mad2.jpg ) 
Figure 1-3. Above, Right. Shoko Asahara —Aum Shinrikyo Leader 
(Source: http://www.mpa.gr/¢gr/other/terrorism/images/aum-shinrikyo-LEADER. jpg ) 
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This case study presents an unclassified summary of the terrorist cult history and motivations 
leading up to and including the Tokyo subway attacks; planning and preparation; tactics and 
techniques of the multiple point-area assault; the immediate aftermath of the incident. Several 
vignettes highlight cult member terrorists, victims, and governmental responses to the attack. 


Timing and method are tools of terrorist choosing and further complicate risk management 
and force protection of a target selected by terrorists. In the case of the Aum Shinrikyo 
cult,’® this subway attack with sarin was one act in a long series of criminal acts that 
spanned several years and involved at least one previous attack with sarin. 


A primary underlying aim of terrorism is a demoralizing psychological effect 
on the target population and its leaders, often with explicit media coverage of 
mass casualty or mass destruction effects, to erode resolve and enhance 
terrorist objectives. 


A former U.S. Secretary of Defense stated the issue of chemical weapon use by terrorists 
and a trend toward increased levels of violence and mayhem in this way: 


“Also looming is the chance that these terror weapons will find their way into 
the hands of individuals and independent groups — fanatical terrorists and 
religious zealots beyond our borders, brooding loners and self-proclaimed 
apocalyptic prophets at home. This is not hyperbole. It is reality.”'” 


Honorable William Cohen 
U.S. Secretary of Defense 
1999 


Introduction 


The 1995 terrorist attack using sarin nerve agent signaled a new level of terrorism using 
weapons of mass destruction or effect.'® A chronology table of Aum Shinrikyo activities 
prior to this incident displays an escalating degree of violence and crime. Activities 
immediately after the sarin subway attack also display selective acts of terrorism as national, 


° Webster’s New World Dictionary of American English, ed. Victoria Neufeldt (Cleveland & New York: Simon 
& Schuster’s, Inc., 1991), 337. Cult, defined as, a quasi-religious group, often living in a colony, with a 
charismatic leader who indoctrinates members with unorthodox or extremist views. 

’ Dana A. Shea and Frank Gottron, Small-scale Terrorist Attacks Using Chemicals and Biological Agents: An 
Assessment Framework and Preliminary Comparisons, Congressional Research Service, The Library of 
Congress, Order Code RL32391, 6, 20 May 2004. 

® National Military Strategy of the United States of America 2004, U.S. Joint Chiefs of Staff, 1. The NMS uses 
the term “WMD” to describe a broad range of adversary capabilities that poses potentially devastating impacts. 
WMD include chemical, biological, radiological, nuclear, and enhanced high explosive weapons as well as other, 
more asymmetrical “weapons.” These type weapons may rely more on disruptive impact than destructive kinetic 
effects. For example, negative psychological effects on people may be more severe than the numbers of lethal 
destruction or the degree of economic damage. 
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regional, and local authorities sought to apprehend Aum Shinrikyo cult members as suspected 
criminals of the sarin attack. A timeline table shows the nearly simultaneous conduct of the 
sarin attacks at various points of the Tokyo subway, and notes the initial civil and military 
actions to the incident. 


Analysis confirms a dedicated plan and preparation for WMD experimentation and use, 
combined with a cultish dedication to a leader with an Armeggeddon-like expectation of the 
contemporary period. Previous use of chemical attacks by the cult bolstered their confidence 
in using a chemical agent, and aided the planning and execution process of the Tokyo subway 
attack, as well as the evasion of the five attack teams from the five separate attack sites. 
Studying this terrorist group and attack incident has other interesting aspects not necessarily 
observed in other well-known terrorist incidents. The specific terrorists in this attack were 
highly educated individuals. Several members of the cult were recruited from, and infiltrated 
into, activities in civil government, law enforcement, commercial industry, postgraduate 
academia, and the national military forces. 


Learning Objectives 


Learning objectives focus on analyzing case study information in order to synthesize and 
evaluate insights from this attack, discern patterns of terrorist method and means, and 
determine likely trends in future terrorist activities. Comparing and contrasting conditions, 
circumstances, and asymmetric options available to the terrorist can enhance judgment to 
recognize vulnerabilities, identify threats, and minimize the ability of terrorism to impact on 
accomplishing a friendly force mission. 


The objectives for this case study are: 
e Describe intelligence indicators that might have been analyzed to create a more 
effective tactical estimate of terrorist intention and capability in the March 20, 


1995 sarin attack. 


e Understand the motivation of Aum Shinrikyo cultists of choosing the population 
of the Tokyo subway system as a terrorist target of high value. 


e Recognize aspects of force protection measures that could apply in a similar U.S. 
situation. 


e Explain terrorist organizational structure and tactics, techniques, and procedures 
(TTP) used for the Tokyo subway system attack. 


e Deduce a trend for terrorist acts with the objective of an increased combination for 
mass Casualties and mass destruction. 


Case Study Overview— Tokyo Chemical Sarin Attack (1995) 


In mid-March 1995, the Aum Shinrikyo cult collected intelligence of a pending raid on 
their compound by government agencies. On very short notice, the Aum Shinrikyo 
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cult leader decided to conduct a sarin attack on a densely populated urban environment 
to distract government authorities and possibly avert the raid on cult facilities. 


On March 20, 1995, five two-person teams entered the Tokyo subway system during the 
morning rush hour of people going to work. The selection of entry points and 
destinations were part of an elaborate action plan to attack the city population with the 
chemical nerve agent sarin along a significant portion of the subway system. The 
subway trains route converged on Kasumigaseki Station in the center of the capital’s 
government district. This district includes many national and international activities 
such as the U.S. Embassy. The attacks occurred at or about 8:00 a.m. when traffic was 
busiest on a normal workday. The attack teams used one member as a vehicle driver 
while the other individual placed a sealed package, camouflaged with newspaper, on 
overhead storage racks or on the subway car floor. Using a sharpened tip of an umbrella, 
the individual punctured the package that allowed sarin liquid to ooze into the car’? and 
gradually vaporize. 
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Figure 1-4. Above, Left. Map of Japan and Tokyo 


(Source: Tokyo Map [before additions] ) 
Figure 1-5. Above, Right. Surface Map of Central Tokyo Attack Area 
(Source: Japan Map [before additions] ) 


Nerve agent effects were observed immediately in various degrees of severity. Some 
people smelled a strong solvent-like odor. Sarin in its pure state is colorless and 


- Commentary No. 60, The Threat of Chemical/Biological Terrorism, August 1995, 1; available from 
http://www.fas.org/irp/threat/cbw/com60e.htm; Internet; accessed 7 January 2005. 
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odorless. The sarin used in the attack was only about 30 percent pure which caused the 
noticeable odor. Initial symptoms included eye irritation, difficulty in breathing, 
coughing, choking, and vomiting. Some people suffered with convulsions. Some people 
lost consciousness. Depending on the degree of sarin released in the confined space of a 
subway car or train station platform, concern of passengers and subway workers quickly 
degraded to panic and hysteria in some cases. Scenes included groups of people 
collapsing in heaps. One platform had over 30 people collapse after being overcome 
by the sarin vapor. A strange smell was strong enough to be noticed at ticket counters 
one floor above one of the train platforms.” 


In reaction to the attack, emergency responses were overwhelmed as the cause of 
symptoms was unclear and reports were conflicting. Similarities to a “toxic gas” 
incident in Matsumoto in 1994 soon alerted medical teams and police of the strong 
possibility of a sarin attack. Nonetheless, citizens, subway workers, and emergency 
response personnel that assisted in the first reactions to the incident were contaminated, 
and in some cases, also became victims. Evacuation and reception of victims to local 
hospitals caused further contamination to several medical workers and hospital staff. 


The attack caused 12 deaths and contaminated or adversely affected between 3500 and 5500 
people. About 1000 people were mildly or moderately suffering sarin effects, with about 500 
people requiring hospitalization. Nonetheless, the psychological trauma or perceived physical 
effects caused several thousand additional people to seek medical treatment. This further 
complicated an already overwhelmed emergency response system. The initial hours of 
response were further confused by reports of a gas explosion as the causal factor.”! 


The original intention of the Aum Shinrikyo was much more devastating in concept. As 
evidenced in raids conducted by the Japanese government on Aum Shinrikyo facilities after 
the subway attack, the cult used sarin that was a much less potent and diluted product. Had the 
sarin been fully potent, had the complete number of sarin packages been punctured and agent 
released, and had a number of other contributing factors been available to the Aum Shinrikyo 
cult, casualties would have been much more severe. Aum Shinrikyo had an expectation that 
thousands of people might die from the sarin attack and additional thousands of people would 
suffer from nerve agent effects or the psychological trauma of a massive chemical weapon attack. 


Background 


The Aum Shinrikyo was founded in 1987 by Chizuo Matsumoto, a middle-aged former yoga 
teacher. In 1984, he formed a company called the Aum Shinsen-no kai which was a yoga 
school and publishing house. He changed his name to Shoko Asahara or “Bright Light,” and 
in 1987, changed the name of his yoga group to the Aum Shinrikyo, a Sanskrit derivative 
literally meaning “Supreme Truth." 


°° U.S. Congress. Senate. Senate Government Affairs Permanent Subcommittee on Investigations. A Case Study 
on the Aum Shinrikyo. Washington, D.C., 31 October 1995, 2; available from 
http://www.fas.org/irp/congress/1995_rpt/aum/part01.htm; Internet; accessed 7 January 2005. 

*! Chemical Terrorism in Japan: The Matsumoto and Tokyo Incidents, 2, available from 
http://www.opcw.org/resp/html/japan.html; Internet; accessed 22 December 2004. 


1-5 


TRADOC G2 Handbook No. 1.01, Terror Operations: Case Studies in Terrorism 25 July 2007 


In August 1989, the Tokyo Metropolitan Government granted the Aum Shinrikyo official 
religious corporation status. This law provided the group various privileges including massive 
tax breaks and de facto immunity from official oversight and prosecution. Under the Japanese 
Religious Corporation Law, after a group is recognized as a religious organization, authorities 
are not permitted to investigate its "religious activities or doctrine". This is broadly interpreted 
to cover almost all activities of the religious group including actions that raise revenue or 
contributions for corporate activities. Although the police could investigate a religious group 
for criminal acts, in practice, this would be difficult if not impossible to do because of the law 
and the government's reluctance to investigate religions. 


With its status as a legally recognized religion, the Aum's activities and character dramatically 
changed. From a small handful of members in 1984, Aum Shinrikyo claimed membership of 
about 10,000 members in 1992 and about 50,000 members worldwide by 1995. Similarly, 
expansion occurred from a one-office operation in Japan in 1984 to over 30 branch offices in 
over six countries. Net worth grew from less than 430 million yen (approximately $4.3 
million) when recognized in 1989 to more than 100 billion yen ($1 billion) by the time of the 
Tokyo incident in 1995. 


The cult of Aum Shinrikyo became more aggressive and dangerous. With its dramatic growth, 
evidence increased of complaints from parents and family members that some Aum recruits 
were kidnapped and physically assaulted by the cult. A number of anti-Aum groups were 
started in this period by families of cult members. The people that formed these groups 
complained that they also became victims of assaults and harassment. 


In February 1990, Asahara decided to become a political power in Japan and announced to his 
members that the Aum Shinrikyo would campaign for representative positions in the Japanese 
Diet [Congress] election. Asahara and 24 other members of his inner circle campaigned for 
these governmental positions under the banner of the Aum's own party - the Shinrito. 
Asahara received only 1700 votes out of approximately 500,000 votes. All of the Aum 
Shinrikyo candidates lost the election with very disappointing voting results. 


The 1990 election defeat appears to be a major decision point for Asahara and the 
direction he would lead Aum Shinrikyo to demonstrate in subsequent years. Aum 
Shinrikyo rejected normal interaction with the larger Japanese society. Announcements of 
Armageddon* and paranoia were recurring with a steady increase in violence and 
confrontation with the government. ~° 


The Aum Shrinrikyo beliefs merged a combination of several philosophies, religions, or 
mystic traditions. With the basis of Buddhism as an initial framework of belief, the cult 
distorted this religion with concepts of a god of destruction, and mystic predictions similar to 
Nostradamus.” Asahara shifted ideas of spiritual liberation through peaceful contemplation 
and discipline to a vision of vaguely explained levels of enlightenment, surviving the 


°° Webster’s New World Dictionary of American English, 74. Armageddon, defined as, biblical reference to 
place where the last, decisive battle between forces of good and evil is to be fought before Judgement Day. 

* A Case Study on the Aum Shinrikyo. 31 October 1995, 1-3. 

*4 Webster’s New World Dictionary of American English, 927. Nostradamus, defined as, a French astrologer, 
Michel de Notredame (1503-1566), known for predictions that have been interpreted in many forms as certain 
events occurred through the centuries and into the present era. 
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destruction of the world, and earning salvation after the pending apocalypse” only through 
the Aum beliefs.*° Ashara stated that salvation was possible only through his teaching as “the 
Spirit of Truth, His Holiness the Master the Shoko Asahara” or the “Supreme Master.” He 
often announced bizarre predictions such as: 


“From now until the year 2000, a series of violent phenomena filled with fear 
that are too difficult to describe will occur. Japan will turn into wasteland as a 
result of a nuclear weapons attack. This will occur from 1996 through January 
1998. An alliance centering on the United States will attack Japan. In large 
cities in Japan, only one-tenth of the population will be able to survive. Nine 
out of ten people will die.”*” 


Shoko Asahara 
Aum Shinrikyo 
1993 


Asahara had been predicting the apocalypse for some time. Japanese government officials 
reported that Asahara published a 1989 treatise on Armageddon and described a worldwide 
calamity based upon a war between Japan and the United States which would start sometime 
in 1997. By the early 1990s, Asahara published numerous predictions and claims of a 
pending world war by 1997 and a catastrophic reduction in the world population. In 1994, 
Asahara presented a public sermon from the Aum Shinrikyo headquarters in Tokyo that 
claimed the Aum Shinrikyo were victims of “poison gas attacks” by Japanese and U.S. 
military aircraft. Alleging attacks since 1988, he stated, “the use of poison gases such as sarin 
were Clearly indicated. The hour of my death has been foretold. The gas phenomenon has 
already happened. Perhaps the nuclear bomb will come next.””® 


°° Ibid., 64. Apocalypse, defined as, Judeo-Christian writings (c. 200 B.C. — c. A.D. 300) depicting symbolically the 
ultimate destruction of evil and triumph of good. 
*° Aum Shinrikyo: Beliefs of the Group, 6-7, available from 
http://religiousmovements.lib.virginia.edu/nrms/aums.html; Internet; accessed 6 January 2005. 
°7 A Case Study on the Aum Shinrikyo. 31 October 1995, 3-4; available from 
bttp.//www.fas.org.irp/congress/ 1995_rpt/aum/part03.htm; Internet; accessed 7 January 2005. 

Ibid., 4. 
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Table 1-1. “Aum Shinrikyo and Selected Events 1984-1995” provides a chronology of key 
activities in the expansion and influence of the Aum Shinrikyo cult leading to the March 1995 
sarin attack, as well as events immediately after the attack. 


Table 1-1. Aum Shinrikyo and Selected Events 1984-1995 


Date Event 


Note: Selected events were not a collated analysis prior to the March 20, 1995 sarin 
attack on Tokyo subway passengers. 


1984 Asahara forms Aum Shinsen-no kai Company for book publishing and yoga 
training center. [Sen, Part 8] 

1987 Company changes name to “Aum Shinrikyo.” [Sen, Part 8] 

1989 Parents and family members of Aum Shinrikyo recruits complain to law 


enforcement officers that Aum Shinrikyo was kidnapping and _ physically 
assaulting recruits and family members. [Sen, Part 8] 


Nov 1989 Mr. Sakamoto, a lawyer representing anti-Aum Shinrikyo groups, kidnapped and 
murdered along with his wife and one-year old son. [After the 1995 Tokyo attack, 
Aum members confess to crime and families’ remains are found.] [Sen, Part V, p.1] 


Aug 1989 Aum Shinrikyo recognized as religious corporation by Tokyo Metropolitan 
Government. [Sen, Part 8] 


Feb 1990 Asahara and some Aum Shinrikyo members run for governmental offices in 
Lower House [Congress]; none elected to office. [Sen, Part 8] 


Oct 1990 Aum Shinrikyo members found guilty in Japanese court of violating the Utilization of 
Land Planning Act. [Sen, Part V, p.1] 


Oct 1992 Aum Shinrikyo “medical mission” sent to Zaire to obtain sample of Ebola virus. 
[Sen, Part 8] 


ca.” 1993 Aum Shinrikyo begins research into and production of chemical agents. [Sen, Part 
V, p.1] 

Jun 1993 Aum Shinrikyo purchases 500,000-acre sheep ranch in Western Australia. [Sen, 
Part 8] 


°° ca, that is circa: about; approximately. 
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Jun 1993 Local residents (approximately 100 people) complain to officials in Koto Ward of 
Tokyo about noxious fumes emitting from building believed to be affiliated with 
Aum Shinrikyo. [After the 1995 Tokyo sarin attack, Aum members tell Japanese 
officials that Aum Shinrikyo dispersed anthrax bacilli at their Tokyo headquarters 
during this 1993 period.] [Sen, Part V, p.1] 


Sep 1993 Asahara and 26 members visit ranch in Australia. [Sen, Part 8] 


Sep 1993 Two Aum Shinrikyo members plead guilty to charge of carrying dangerous 
chemicals on an airplane in Perth, Australia. [Sen, Part V, p.1] 


Apr 1994 Aum Shinrikyo members visit Australia to investigate possibility of extracting 
uranium. [Sen, Part 8] 


Jun 1994 Aum Shinrikyo purchase a MI-17 helicopter from Russia. [Sen, Part 8] 


Jun 1994 231 people in seven towns in western Japan (Nara prefecture) suffer rash and eye 
irritations from unknown source. [Sen, Part 8] 


Jun 1994 Sarin chemical agent attack in Matsumoto kills seven people and injures over 200 
people. [Sen, Part V, p.2] 


Jul 1994 Aum Shinrikyo sell sheep ranch in Australia at a financial loss. [Sen, Part 8] 
Jul 1994 Aum Shinrikyo begins manufacturing AK-74 rifles. [Sen, Part V, p.2] 
Nov 1994 Aum Shinrikyo members break into Tokyo Metropolitan Police Department 


building in order to steal driver license data. [Sen, Part V, p.2] 


Dec 1994 Residents complain repeatedly of peculiar odors from the Aum Shinrikyo’s 
Kamikuishiki [north of Tokyo] complex. [Sen, Part 8] 


Dec 1994 Aum Shinrikyo members break into Hiroshima Factory of the Mitsubishi Heavy 
Industries in order to steal technical documents on weapons such as tanks and 
artillery. [Sen, Part V, p.2] 


Dec 1994 Aum Shinrikyo’s “Home Affairs Ministry” head Tomomitsu Niimi sprays Tadahiro 
Hamaguchi with VX nerve agent; man dies ten days later. [Sen, Part V, p.2] 


Jan 1995 Niimi attacks Hiruki Nagaoka, leader of the Association of the Victims of Aum 
Shinrikyo, with VX nerve gas; Nagaoka survives. [Sen, Part 8] 


Feb 1995 A village office administrator kidnapped and killed by drug injection; his body is 
burned in microwave incinerator and remains discarded. [Sen, Part V, p.2] 


Feb 1995 An Aum Shinrikyo follower pharmacist, Otaro Ochida, is hanged in Aum 
Shinrikyo facility; his body is burned in microwave incinerator and remains 
discarded. [Sen, Part V, p.2] 


ca. Mar 1995 Aum Shinrikyo members assist in firebombing attack of Aum Shinrikyo 
headquarters in effort to inspire public sympathy for the cult just before the Tokyo 
sarin attack. [Sen, Part V, p.2] 
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Mar 5, 1995 Eleven people hospitalized from strange fumes in the Keihin Kyuko train line in 
Yokohama. [Sen, Part 8] 


Mar 15, 1995 Three attaché cases containing liquid, fans, vents, and batteries are discovered in 
Kasun-dgaseki subway station in Tokyo. [Sen, Part 8] 


Mar 20, 1995 Twelve people die and up to 5500 people injured from sarin agent release in 
five subway trains of Tokyo subway system. 


Mar 30, 1995 Director of National Police Agency is shot. [Sen, Part 8] 


Apr 4, 1995 Odors noticed from suspected Aum Shinrikyo location in Shinjuku Ward, Tokyo. 
[Sen, Part 8] 


Apr 11, 1995 Twenty people complain of sore throats and foul odor on Keihin line in 
Yokohama. [Sen, Part 8] 


Apr 19, 1995 500 people hospitalized due to fumes in the Yokohama railway system. [Sen, Part 8] 
Apr 21, 1995 27 people overcome by fumes in a store near the Yokohama rail station. [Sen, Part 8] 
Apr 23, 1995 Hideo Murai, Aum Shinrikyo member in charge of the “Science and Technology 


Ministry” stabbed to death in front of Aum Shinrikyo headquarters. 


May 5, 1995 Two bags of “poison gas” found in the men’s restroom in the Shinjuku subway 
station in Tokyo. [Sen, Part 8] 


May 16, 1995 Parcel bomb explodes at office of Tokyo’s Governor; one aide is wounded. [Sen, 
Part 8] 
Jul 4, 1995 Poison gas found in women’s restroom on the Hibiya line, Kayaba-Cho subway 


station and in men’s restroom of Shinjuku station in Tokyo. [Sen, Part 8] 


Note: During weeks and months following the March 20, 1995 sarin attack, several of 
the Aum Shinrikyo leadership [including Asahara, were arrested. Hearings, trials, 
and convictions are not included in this table. 


Sources: 


U.S. Congress. Senate. Senate Government Affairs Permanent Subcommittee on Investigations. Global 
Proliferation of Weapons of Mass Destruction: A Case Study on the Aum Shinrikyo. Staff Statement 31 
October 1995. Available from http://www.fas.org/irp/congress/1995_rpt/aum/index.html; Internet; 
Accessed 7 January 2005. 

U.S. Congress. Senate. Global Proliferation of Weapons of Mass Destruction: A Case Study on the 
Aum Shinrikyo. Available from http://www.fas.org/irp/congress/1995_rpt/aum/part05.htm [table code 
Sen, Part V]; Internet; Accessed 7 January 2005. 

Ibid., [table code Sen, Part 8]. 


Planning and Preparation: Matsumoto — Sarin in the Air 


Almost one year before the 1995 Tokyo sarin attack, the industrial and tourist city of 
Matsumoto, Japan experienced a sarin chemical attack in one of its residential 
neighborhoods. Sometime during the early evening hours of June 27, 1994, Aum 
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Shinrikyo cult members used a converted truck to disperse sarin toward a group of houses, 
apartment buildings, and dormitory. 

About 11:00 p.m., the local police and fire department started to receive calls for assistance 
from frightened residents. Residents, disoriented and ill when firefighters or policemen 
arrived, were transported to the hospital. Casualties mounted as the police used loudspeakers 
to warn local citizens what they thought was a toxic gas leak. Emergency response and 
medical treatment and evacuation continued throughout the night. However, by the early 
morning hours, six people had died, and another person would die that same day.”’ Over 500 
hundred people** were transported to hospital facilities with about 50 people admitted for 
medical care. Over 250 people received outpatient treatment.” 


Japanese authorities conducted a special investigation of the attack, or “accident” as the 
incident was initially called, and within a week confirmed that sarin had been identified by 
gas chromatography-mass spectrometry (GC-MS) results. At the time, no evidence identified 
a link to incriminate the Aum Shinrikyo cult. Nonetheless, the incident signaled the 
escalation of a known threat and demonstrated the danger of a chemical attack using sarin. 


The Aum Shinrikyo terrorist team improvised a dissemination system within a truck to vent 
sarin vapor during an approximate 20-minute period. A light breeze allowed the sarin to drift 
through open windows or doorways to spread over an area about 800 by 750 meters. Most of 
the sarin effects occurred within an area of about 400 by 300 meters.“ 


Of note, emergency response workers were affected by the sarin too. Of the over 50 rescue 
workers operating at the attack site, 18 workers experienced negative effects. One rescue 
worker was admitted to the hospital. Although other workers did not seek medical assistance 
at the time, they displayed mild symptoms that included eye pain, darkness of vision, nausea, 
vomiting, headache, mucous discharge from the nose, narrowing field of vision, sore throat, 
fatigue, or shortness of breath. Physical examinations conducted three weeks after the attack 
on rescue workers identified no remaining abnormal symptoms.”” 


During subsequent investigations of the Matsumoto incident and the operations of the Aum 
Shinrikyo cult, law enforcement authorities determined the reason for the attack. The cult 
wanted to slow or stop a civil lawsuit over real estate. The three judges sitting on the legal 
panel resided in a dormitory of this neighborhood. Not wanting to risk a legal decision against 
the cult, the Aum Shinrikyo decided to stop the judges from making any decision by attacking 
them, and others in the area, with a vapor of sarin nerve agent. 


3! Chemical & Biological Arms Control Institute, The Matsumoto Incident: Sarin Poisoning in a Japanese 
Residential Community, (Fall 1994), 2 and 3; available from 
http://www.cbaci.org/pubs/fact_sheets/matsumoto.html; Internet; accessed 9 February 2005. 
*° Kyle B. Olson, Aum Shinrikyo: Once and Future Threat?, Center for Disease Control, Emerging Infectious 
Diseases (July-August 2000), 1; available from http://www.cdc.gov/ncidod/EID/vol5no04/olson.htm; Internet; 
accessed 25 January 2005. 
°° Chemical Terrorism in Japan: The Matsumoto and Tokyo Incidents, 1; available at 
Http://www.opew.org/resp/himl/japan.html; Internet; accessed 22 December 2004. 

Ibid., 1. 
= Nakajima, T; S Sato; H Morita; and N Yanagisawa, Operational & Environmental Medicine Online, “Sarin 
Poisoning of a Rescue Team in the Matsumoto Sarin Incident in Japan,” (vol 54, 1997), 1; available from 
http://oem.bmjjournals.com/cgi/content/abstract/54/10/697; Internet; accessed 9 February 2005. 
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The Decision to Attack Tokyo 


Hindsight demonstrates clearly the significant intent and capability of the Aum Shinrikyo to 
produce and use chemical agents against people they believed to be threats to their cult.°’ The 
notoriety of the Matsumoto incident was just one in a series of chemical agent incidents. 
Some reports indicate Aum Shinrikyo first attempted to buy sarin as early as 1988 from an 
alleged weapons smuggler or later from contacts in the former Soviet Union. Eventually, the 
Aum Shinrikyo leadership decided to develop their own capability for producing sarin. 
Scientists recruited into the Aum Shinrikyo developed and produced small amounts of sarin in 
late 1993 and into 1994. A facility called Satyan 7 [or Satian Building No.7] was built with 
Aum funds to mass produce sarin. Several million dollars, scientists, and skilled workers 
created a high-quality facility with computer-controlled reactors and industrial packaging 
equipment to automatically package specified amounts of sarin and seal the bags.*” However, 
based on a chemical agent production accident in 1994, the facility was not used in any mass 
production. Scientists continued to experiment with precursor chemicals to manufacture 
small amounts of sarin measured in grams or kilograms. Notwithstanding, the Aum 
Shinrikyo sustained an aim to have a capability for producing tons of sarin. 


Japanese law enforcement organizations continued investigations on several incidents and 
gathered information that indicated the Aum Shinrikyo might be involved in incidents 
involving chemical attacks. However, the Japanese Constitution and laws protecting 
recognized religious organizations prevented Japanese authorities from certain levels of 
detailed inquiry or direct action against the Aum Shinrikyo. Reports and allegations continued 
to indicate Aum Shinrikyo involvement in several criminal actions, and newspaper editorials 
suggested an Aum Shinrikyo link to the Matsumoto incident. 


Eventually, Japanese police linked the Aum Shinrikyo to crime scene evidence involving a 
kidnapping and murder. Based on this information, police used this linkage to obtain a search 
watrant to enter the Kamikuishiki compound of the Aum Shinrikyo. In planning the raid, 
police were aware of suspicious reports about facilities on the compound and possible 
chemical agent manufacturing. When policemen coordinated with the Japanese Self Defense 
Force (JDSF) [military forces] for contingencies in chemical protective measures, members of 
Aum Shinrikyo inside the JSDF alerted the Aum Shinrikyo leadership of the planned raid on 
the cult compound. 


Shoko Asahara, as the leader of the Aum Shinrikyo, decided to take an immediate preemptive 
action by conducting a major chemical nerve agent sarin attack. The intention was to distract 
police and prevent the raid on the Kamikuishiki compound.” 


°° A Case Study on the Aum Shinrikyo. 31 October 1995, 11. Reports link Aum Shinrikyo with chemical nerve 
agent VX attacks in December 1994 and January 1995. In one incident the victim died, and in the other incident 
the victim was in a coma for several weeks but survived. 

37 Nerve Agent: GB (Sarin), 8 and 9; available from http://cbwinfo.com/Chemical/OP Nerve/GB.shtml; Internet; 
accessed 14 February 2005. 

** Tbid., 9 and 10. 
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Tokyo — Recipe for Disaster 


The five terrorists selected to conduct the actual attacks rehearsed at the Aum Shinrikyo’s 
Kamikuishiki compound near Mt. Fugi. In the early morning hours of March 20, 1995, they 
used umbrellas with a sharpened tip to practice piercing plastic bags filled with water. 
Preliminary contingency training for such an event may have spanned several days or weeks, 
but the decision to attack, final checks, and rehearsals were conducted within hours of the 
attack. After the final rehearsal period and coordination at the compound, they were issued 
hypodermic needles filled with an antidote for nerve agent symptoms if they experienced 
sarin effects from the attack.” 


Five Sarin Attacks in Tokyo Subway 


NOT TO SCALE 
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Figure 1-6. Five Sarin Attacks in Tokyo Subway 


The Sarin Attack 


Five two-person teams conducted a nearly simultaneous attack on thousands of passengers of 
the Tokyo subway system. One attacker and one automobile driver comprised each of the five 
teams. Four of the subway rider-attackers carried two sarin packages and one subway rider- 
attacker carried three packages. Each of the packages held about 20 ounces of sarin nerve 


39 Murakami, Haruki, Underground (New York: Vintage International, 2001), 10-11. 
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agent." Fortunately, the sarin was only about 30 percent pure in its concentration. This 
dilution of the sarin was a significant factor in limiting the number of casualties in attacks 
about to occur in the Tokyo subway system. 


The morning rush of downtown Tokyo had already started with thousands of people using the 
public subway system to reach their places of business and appointments. The five teams 
departed from Aum Shinrikyo facilities and drove to designated subway stations selected for 
their respective entry to the several subway lines. 


Masato Yokoyama and Kiyotaka Tonozaki were assigned the objective of attacking the 
Marunouchi Line. On the way to the subway station, Yokoyama bought a newspaper and 
wrapped the sarin packages to disguise the weapon. Wearing a wig and fake glasses, 
Yokoyama boarded the Shinjuku subway at 07:39 a.m. as the train headed southeast along a 
route to Ikebukuro. He poked his sarin packages as the subway approached the Yotsuya 
Station. His poking released sarin from only one of the two packages. Yokoyama departed 
the subway car and went immediately to a rest room and washed his umbrella tip with water. 
He met Tonozaki in the waiting automobile” and departed the area. 


By 08:30 a.m., this subway train reached the end of the line at Ikebukuro and started a return 
trip along the line. At the Ikebukuro Station, the train passengers were evacuated and a search 
of the train did not identify anything suspicious. As the train resumed the subway route, 
passengers were feeling unpleasant and reported a strange object in one of the cars. 


Meanwhile on the Hibiya Line, Yasuo Hayashi and Shigeo Sugimoto were about to start their 
attack from the Ueno Station. As Sugimoto drove the automobile to the subway station, 
Hayashi wrapped the sarin packages, three packages in this case, in newspaper. Hayashi 
boarded the subway at 07:43 a.m. and once the train was underway, dropped the packages on 
the floor. He punctured the packages with his umbrella tip at the Akihabara Station, and 
departed the subway train to meet the waiting Sugimoto and automobile. They returned to the 
local Aum Shinrikyo headquarters. As the sarin started to evaporate or came in contact with 
people, a series of subway stations experienced casualties as the subway train continued its 
route. Sarin effects were most significant along a route of five stations. This was the most 
disastrous of the five attacks with eight deaths and 275 people with serious injuries.” 


Kenichi Hirose and Koichi Kitamura also attacked the Marunouchi Line. Hirose wrapped the 
sarin packages in a sports tabloid, and boarded the subway about 07:45 am. His 
apprehension and mounting tension caused him to depart a subway car and stand on the 
subway platform for a brief moment. He reboarded a train car and as the subway approached 
the Ochanomizu Station, he dropped the sarin package on the subway car floor and poked the 
package with his umbrella tip. He departed the subway and linked up with Kitamura. 


Before entering the automobile, Hirose rinsed the umbrella tip with bottled water and tossed 
the item in the trunk of the car. Even with these simplistic decontamination precautions, 
Hirose started to show symptoms of nerve agent poisoning. He injected himself with an 


“° Chemical Terrorism in Japan: The Matsumoto and Tokyo Incidents, 1; available from 
http://www.opcw.org/resp/html/japan.html; Internet; accessed 22 December 2004. 

“| Murakami, Haruki, Underground, 104-106. 

“ Tbid., 144-145. 
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antidote, and subsequently required additional emergency care at the local Aum Shinrikyo 
headquarters. The attack at this subway line caused one passenger death and 358 serious injuries.” 


The Chyoda Line was the attack objective of Ikuo Hayashi and Tomomitsu Niimi. Enroute to 
the station, the team purchased newspapers to wrap and camouflage the sarin packages. 
Hiyashi boarded the southwest bound subway about 07:48 a.m. Wearing a surgical mask often 
worn by citizens to reduce the spread of colds during this season, he looked around the 
subway car as he prepared to release the sarin. Dropping the packages by his foot, he poked 
the packages several times with the umbrella. Although only one of the two sarin packages 
was punctured, casualties at this site eventually totaled two deaths and 231 people with 
serious injuries. Hayashi departed the train at the Shin-ochanomizu Station and met Niimi in 
a waiting automobile. Both terrorists returned to the local Aum Shinrikyo headquarters.“ 


The fifth attack started at the Ebisu Station of the Hibiya Line when Toru Toyoda punctured 
his two sarin packages with an umbrella tip. He had been driven from the local Aum 
Shinrikyo headquarters to the Naka-meguro Station by Katsuya Takahashi. Toyoda departed 
the subway station at 07:59 a.m., sat down in a subway car, and dropped his sarin packages 
on the floor. Leaving the train immediately after puncturing the packages, he met the 
automobile and returned to the Aum Shinrikyo headquarters. During this trip, Toyoda 
displayed symptoms of sarin poisoning, but did not experience any permanent effects. 
This attack resulted in one death and 532 seriously injured people.” 


Table 1-2. “Timeline of Sarin Attack in Tokyo Subway (1995)” presents the nearly 
simultaneous attacks along five subway lines trains on three major subway lines of the 
network within a 20-minute period, as well as the mass confusion and anxiety as the 
emergency incident of unknown origin defined into an attack with a chemical agent. 
Emergency response technicians, transportation system workers, and law enforcement 
officials were quickly overwhelmed as casualties surpassed any normal triage capability at the 
attack sites or the several local hospitals. 


Lack of timely communication or protocols for combined emergency response to a verify a 
chemical agent attack; effective command and control of civil and government organizations 
in the response effort; quarantine of effected areas, equipment, and people; and slow public 
announcement of the sarin threat further complicated the response and allowed additional 
people to be contaminated. 


8 Tbid., 59-61. 
“4 Tbid., 9, 60. 
“ Murakami, Haruki, Underground, 119-120. 
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Table 1-2. Timeline of Sarin Attack in Tokyo Subway (1995) 


Chronology March 20, 1995 Selected Events Sequence 

07:39-07:59 Five Aum Shinrikyo members each enter a separate subway train in Tokyo 
subway system with sarin packets. [ZH, 2] 

07:39 Yokoyama boards Shinjuka train, and punctures one packet at Yottsuya 
Station. [WE, 4] 

07:43 Hayashi Yasuo boards southwest bound train at Ueno Station, and punctures 
packets at Akihabara Station. [WE, 5] 

eas O45 Hirose boards westbound Marunouchi train, and punctures packets at 
Ochanomizu Station. [WE, 4] 

07:48 Hayashi Ikuo boards southwest bound Chiyoda train, and punctures packet at 
Shin-ochanomizu Station. [WE, 3] 

07:59 Toyoda boards northeast bound Hibiya train, and punctures packets at Ebisu 
Station. [WE, 4] 

ca. 08:00 Five near simultaneous attacks release sarin in subway train cars. [CM, 12] 

ca. 08:00 Passenger at Kodenmacho Station kicks packet from train unto the platform. 
Packet leaks to form puddle. [ZH, 2] 

ca. 08:00 Five subway trains converge on Kasumigaseki Station near the center of 
Tokyo’s government offices. [CM, 8] 

08:09 First emergency call arrives at Tokyo Metropolitan Fire Department. 

08:09-09:10 Numerous emergency calls arrive at Tokyo Metropolitan Fire Department from 
fifteen different subway stations. [CM, 17] 

08:10 Passenger on southwest bound train presses emergency stop button. Several 
train passengers collapse unto the platform when the train arrives at the Tsukiji 
Station. [ZH, 2] 

ca. 08:10 Train staff make progressive announcements to train passengers, “sick 
passenger...explosion occurred at Tsukiji...Tsukiji next stop...Evacuate, 
Evacuate, Evacuate.” [CM, 12] 

08:16 St. Luke’s Hospital notified of a subway incident. 

08:17 First report of “fumes.” [ZH, 2] 

08:20 First report to Tokyo emergency switchboard with “foul odor” at Kamiyacho 
Station. [CM, 26] 

08:26 “Bad smell” noticed by several passengers at Nakano-sakaue Station of 


“6 ca,, that is circa: about; approximately. 
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08:28 


ca. 08:30 


08:32-09:27 


08:33 


08:35 


08:38 


ca. 08:45-09:15 


ca. 08:40 


08:44 


08:50 


ca. 09:00 


ca. 09:00 


09:20 


09:27 


08:40-09:40 


before 11:00 


ca. 11:00 


ca. 16:50-21:20 


First 24 Hours 


After the Attack 


Several 
After the Attack 


Weeks 


Marunouchi line. 
First victims arrive on foot at St. Luke’s Hospital 


Train is evacuated and searched at the Ikebukuro Station. No packets are 
discovered and train resumes schedule. [ZH, 2] 


Train at Ikebukuro Station departs on return route, complete route and returns to 
Ikebukuro Station. 


Fire Department emergency squad receives call of six passengers collapsing at 
Nakano Sakaue station. [CM, 26] 


Hibiya line stops all service. 


Train reaches Ogikubo Station terminal point on Marunouchi line, boards 
additional passengers, and starts route in opposite direction. 


During this period, train staff removes packets at Hongo-san-chome Station and 
mops train car floor. [ZH, 2] 


First ambulances with casualties arrive at St. Luke’s Hospital. [ZH, 2] 


National Police Agency (NPA) convinced of major incident in subway system 
and significant response required. [CM, 13] 


Emergency medical sites are established on outside subway stations. [ZH, 2] 


Police start to block access to subways that are not already closed by subway 
staff. [CM, 26] 


Tokyo Metropolitan Fire Department establishes emergency response 
operations headquarters at affected subway stations. [CM, 17] 


St. Luke’s Hospital declares medical emergency and initiates emergency 
emergency medical treatment. 


Train on Marunouchi line removed from service. [ZH, 2] 

St. Luke’s Hospital receives surge of 150 patients from sarin attack. [CM, 30] 
Police have confirmation that sarin is source of attack, but hospitals and 
Tokyo Metropolitan Fire Department not officially notified of sarin agent. 


[CM, 22] 


Police announce at a press conference that sarin is source of subway attacks. 
[CM, 23] 


Self Defense Force teams decontaminate train cars with bleach and water 
solution. [CM, 28] 


Ten people die from sarin attack. Nine people died at the incident sites, and one 
person died just after arrival at a hospital. [PK, 2] 


Two more people die from complications of brain damage suffered from the 
sarin attack. [KP, 2] 
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Sources: 

Discovery Channel — Zero Hour. Zero Hour — Tokyo’s Sarin Gas Attack. Database on-line. Available 
from http://www.discoverychannel.co.uk/zerohour/feature4.shtml; Internet; Accessed 22 December 
2004. [table code ZH] 

Pangi, Robyn. Consequence Management in the 1995 Sarin Attacks on the Tokyo Japanese Subway 
System. BCSIA Discussion Paper 2002-4, ESDP Discussion Paper ESDP-2002-01, John F. Kennedy 
School of Government, Harvard university, February 2002. [table code CM] 

Kulling, Per. KAMEDO Reports No 71 The Terrorist Attack with Sarin in Tokyo: Summary, 
Experience, and Conclusions, 1995. database on-line. Available from 
http://www.sos.se/SOS/PUBL/REFERENG/980020.htm; Internet; Accessed 22 December 2004. [table 
code PK] 

Wikipedia, The Free Encyclopedia (2004), s.v. “Sarin Gas Attack on the Tokyo Subway.” Available 
from http://en.wikipedia.org/wiki/Sarin_gas attack on the Tokyo_subway; Internet; Accessed 22 
December 2004. [table code WE] 


Supplemental Vignettes -The Immediate Aftermath 


Communications at several levels of civil and government organizations were not effective 
for public safety and services in a crisis response. Numerous examples arose of civilian, 
transit authority, and first-responder awareness of a critical problem but displayed a slowness 
in reporting or coordinating action. Passengers in the trains were the first to observe other 
passengers with symptoms of illness, or felt sick themselves. The subway train cars had a direct 
intercommunication system from each car to the train conductor, however, passengers were either 
not aware of the system or were not willing to be the first to declare a serious problem. 


Once the train control center was notified of a critical issue without knowing the full extent of 
the problem, trains were allowed to continue on their scheduled routes. Three trains 
continued their operation for a period of time before being pulled from active service. This 
continuation of service contaminated people and facilities along the train line. Additionally, 
other station managers and trains were not alerted along the same lines. As more trains and 
their passengers were attacked, a sluggish alert protocol delayed immediate reactions and 
effective emergency response. Subway cleaning crews were not aware of the threat when 
dispatched to clean platform or train car areas which caused some crew personnel to 
become casualties to the sarin. Due to insufficient training on how to decontaminate an 
area for this type of agent, some train yard areas were further contaminated.” 


In contrast to what was contaminated, many factors have been identified that minimized sarin 
effects in the subway attack, with the dilution of the sarin as a frequently stated reason. The 
relatively rapid response of emergency treatment and decontamination teams, and an 
exceptionally powerful air exchange system in the subway stations assisted in reducing the 
number of casualties.”° 


O11S, Department of Transportation, Federal Transit Administration, Office of Research, Demonstration and 
Innovation. US-Japan Mass Transit Security Workshop Proceedings and Meetings: January 2002 (March 2002) 
by the Federal Transit Administration (FTA) and the Japanese Ministry of Land Infrastructure and Transport, 9 
and 10; available from http://ntl.bts.gow/lib/12000/12100/12190/; Internet; accessed 1 February 2005. 

“8 Canadian Security Intelligence Service, Commentary No. 60, The Threat of Chemical/Biological Terrorism, 
August 1995, 2. available from http://www. fas.org/irp/threat/cbw/com60e.htm; Internet; accessed 7 January 
2005. 


+18 


TRADOC G2 Handbook No. 1.01, Terror Operations: Case Studies in Terrorism 25 July 2007 


By evening, fifteen subway stations had been affected by the sarin. Of the three train lines 
(Marunouchi, Hibiya, and Chiyoda) contaminated with sarin, all service was suspended on the 
Hibiya line the day of the attack. Nonetheless, regular service resumed the following day. On 
the Marunouchi and Chiyoda lines, regular service resumed by late afternoon on the same day 
as the attack, except for the Kasumigaseki Station. This station resumed service on the 
following day.” 


The Terrorists 


The court trials and legal proceeding have taken, in some cases, several years to come to a 
legal decision on criminal charges. The information in Table 1-3. “Current Legal Status — 
Tokyo Sarin Terrorists,” presents the court sentences against the Aum Shinrikyo leader, as 
well as the sentences against members of the five two-person teams that actually 
conducted the chemical nerve agent sarin attacks on people in the Tokyo subway system 
on March 20, 1995. As the judge was reading the court verdict to the cult leader, 
Asahara smiled, laughed, and later yawned but showed no real emotion to his 
death sentence.” 


Documents seized by Japanese police from Aum facilities after the March 1995 Tokyo attack 
indicate that the apocalypse date predicted by the Aum Shinrikyo cult may have been moved 
from 1997 to an earlier date of November 1995. Aum Shinrikyo articles in early 1995 
contained anti-Japanese and anti-U.S. editorials that included one article questioning 
assassination of the U.S. President and other assassinations of Japanese officials. The cult 
claimed that the Japanese government and U.S. military had attacked their compound with 
“poison gas.” An October 1995 U.S. Senate paper noted an unconfirmed report that the cult 
may have planned to send sarin packages to locations in the United States.”! 


Table 1-3. Current Legal Status -- Tokyo Sarin Terrorists 


Name Court Sentence 

Shoko Asahara (Aum Shinrikyo Leader) Death 

Masato Yokoyama (Sarin Attacker) Death 

Kiyotaka Tonozaki (Accomplice-Driver) Life in Prison 

Toru Toyoda (Sarin Attacker) Death 

Katsuya Takahashi (Accomplice-Driver) Still at Large 
Kenichi Hirose (Sarin Attacker) Death 

Koichi Kitamura (Accomplice-Driver) Life in Prison 

Ikuo Hayashi (Sarin Attacker) Life in Prison 
Tomomitsu Niimi (Accomplice-Driver) Death 

Yasuo Hayashi (Sarin Attacker) Death 

Shigeo Sugimoto (Accomplice-Driver) Death 

Note: At time of handbook publication, some appeal actions continue on behalf of convicted terrorists. 


“U.S. Department of Transportation, US-Japan Mass Transit Security Workshop Proceedings and Meetings: 
January 2002, 33. 

°° Court TV’s Crime Library: Criminal Minds and Methods, “Death Sentence,” available from 
http://www.crimelibrary.comy/terrorists_spies/terrorists/prophet/26.html?sect+22; Internet; accessed 18 April 2005. 
°! A Case Study on the Aum Shinrikyo. 31 October 1995, 4-6. 
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In determining the motivation of terrorist groups willing to use WMD such as sarin, at least 
six characteristics to consider are: charismatic leadership; no external constituency; 
apocalyptic vision; presentation as a loner or splinter group; sense of paranoia or grandiosity; 
and preemptive aggression. Comparing these characteristics to the Aum Shinrikyo, the cult 
displayed these types of actions and behavior. The Aum Shinrikyo combined intent with 
capability to conduct attacks using WMD.” 


Table 1-1. “Aum Shinrikyo and Selected Events 1984-1995,” notes several incidents after the 
Tokyo sarin attack that included cyanide chemical devices in public facilities, a mail bomb to a 
Japanese official, and the murder of an Aum Shinrikyo associate in front of an Aum Shinrikyo 
office. Cult reaction, even after the police raids following the March 20, 1995 subway attack, 
indicated a number of dedicated cult members using terror as a tactic. Other actions may have 
involved copy-cat type criminal acts. Three months after the Tokyo subway sarin attack, a 
commercial airline flight, ANA Flight 857 heading from Tokyo to Hakodate was hijacked using 
fake sarin containers and explosives.” 


Law enforcement scrutiny and legal actions on Aum Shinrikyo escalated dramatically after 
the Tokyo attack. Media coverage and political debate continued to highlight events in this 
cult, even after the cult changed its name in to “Aleph” in January 2000. Public domain 
websites maintain chronologies of events and issues.” 


The Victims 


The number of injured citizens in 
the Tokyo subway sarin attack 
totaled about 3800 people with 
about 1000 persons requiring 
hospitalization. Using data from 
one of the several hospitals that 
treated casualties in the sarin 
attack, injuries although serious 
for many people, could have been 
a much more catastrophic 
incident. Of 641 victims at that 
hospital, five were in a critical state. 
Two of these patients died while 
three patients fully recovered. 
Major symptoms were severe 
convulsions and cardiac arrest. 


Figure 1-7. Triage at Tokyo Subway Exit 
(Source: ) 


°° Steve Bowman and Helit Barel, Weapons of Mass Destruction — The Terrorist Threat RS 20412 (Washington, 
D.C.: Congressional Research Service Report for Congress, 8 December 1999), 3 and 6; available from 
http://www. fas.org/irp/crs/RS20412.pdf; Internet; accessed 7 January 2005. 

°° U.S. Department of Transportation, US-Japan Mass Transit Security Workshop Proceedings and Meetings: 
January 2002, 21. 

54 News & Articles on Aum Shinrikyo, Surfwax Political News; available from 
http://news.surfwax.com/politics/files/Aum_Shinrikyo.html; Internet; accessed 13 January 2005. 
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Many patients with moderate symptoms were primarily eye problems and headaches. 106 
people were hospitalized overnight for observation and treatment. Contraction of the pupil of 
the eye was a most common symptom, while other signs included pain in the eyes, blurred 
vision, and visual darkness. Shortness of breath, nausea, vomiting, muscle weakness, and 
cough-ing were other symptoms. Many of the people with mild attack symptoms complained 
primarily of eye problems. These were treated and released after six hours of observation at 
the hospital. 


Demographics of this hospital’s patient population represented a mix of about 40 percent 
female and 60 percent male with ages ranging 13 years to 60 years old. Four women were 
pregnant. Based on follow-up surveys to patients one month after the attack, about 60 percent 
suffered from some post-incident symptom and remained at about the same levels after three 
and six months.” A separate medical study of rescue team members and police officers 
exposed to sarin in the Tokyo subway emergency response was conducted about three years 
after the attack. Although the medical report states that further study of possible other 
contributing factors was required, the study observed a chronic decline of memory function in 
the group (rescue team members and police officers) when compared with a control group.”° 


Case Discussion Questions 
Intelligence and Threat Warning? 


e What activities preceding the March 1995 sarin attack might have indicated the intent of 
the Aum Shinrikyo cult to use WMD against a civilian population? 


e Did Aum Shinrikyo announcements state or indicate a security risk to U.S. national interests? 


e How were subway cleaning crews and first-responder emergency treatment personnel 
warned and protected initially from sarin contamination? 


Security Measures in Effect? 


e How did Japanese national laws relating to religious groups restrict investigative 
procedures by law enforcement organizations? 


e What centralized command and control procedures existed among Japanese civil 
government-military organizations for emergency response to a catastrophic incident? 


5° Ohbu, Sadayoshi; Akira Yamashina; Nobukatsu Takasu; Tatsuo Yamaguchi; Tetsuo Murai; Kanzoh Nakano; 
Yukio Matsui; Ryuzo Mikamai; Kenji Sakurai; and Shigeaki Hinohara, Sarin Poisoning on Tokyo Subway, 1 to 
4; available from http://www.sma.org/smj/97jun3.htm; Internet; accessed 22 December 2004. 

°6 Nishiwaki, Yuji; Kazuhiko Maekawa; Yasutaka Ogawa; Nozomu Asukai; Masayasu Minami; Kazuyuki 
Omae; and the Sarin Health Effects Study Group, Effects of Sarin on the Nervous System in Rescue Team Staff 
members and Police Officers 3 Years after the Tokyo Subway Sarin Attack, 1-7; available from 
http://ehp.niehs.nih.gov/members/2001/109p1169-1173nishiwaki/nishiwaki-full.html; Internet; accessed 25 
January 2005. 
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Terrorist Tactics, Techniques, and Procedures? 


e What precedents in domestic terrorism, using chemical agents, had occurred in Japan that 
could have focused government awareness and counter actions? 


e What type of rehearsals did the teams conduct for the attack? 
e What was the terrorist rationale for using small packets to deliver the sarin? 
e How could terrorists have increased mass casualty effects as even more devastating? 


e How did the terrorist group structure itself, communicate, and operate during the phases of 
final planning, rehearsals, and execution of the sarin attack? 


Assessment 


A U.S. Congressional Research Service study on the terrorist threat and weapons of mass 
destruction spotlighted several interesting aspects of the Aum Shinrikyo and its Tokyo sarin 
attack. In a developmental period of several years in the early 1990s, the cult experimented 
and attempted to acquire various forms of WMD. Recruiting for expertise included Aum 
Shinrikyo activities at universities with particular emphasis on physics, engineering, and 
computer departments.” A worldwide cult membership reported in the tens of thousands, an 
asset inventory net worth in the range of $1 billion, and connections with diverse civilian, 
academic, and international business interests provided research facilities, equipment, and 
scientific expertise for an ominous capability. Although initiatives to acquire biological 
weapons appear to have failed, the Matsumoto and Tokyo attacks demonstrated a clear 
purpose of causing mass casualties with a cult-manufactured chemical nerve agent. 


After the Tokyo attack, assessment by the Central Intelligence Agency and Federal Bureau of 
Investigation had very little information on the Aum Shinrikyo. One immediate concern noted 
by US officials in Tokyo was the fact that Aum Shinrikyo had an office several blocks from 
Times Square in downtown New York City. No illegal activities were uncovered when 
searching these premises with a warrant. Nonetheless, information appears to note a significant 
failure to identify this emergent threat to the USA until well after the Tokyo sarin attack.”® 


In Japan, contemporary laws and legal system of Japan provided special protections to 
recognized religious groups and placed significant constraints on law enforcement 
surveillance and investigation, even when incidents and allegations indicated a very 
suspicious manner of cult operations. 


At the time of the Tokyo attack, the Matsumoto attack was still officially labeled as an 
“accident.” Suspicion of linking Aum Shinrikyo and sarin use at Matasumoto was increasing 


*” Robyn, Pangi, Consequence Management in the 1995 Sarin Attacks on the Tokyo Japanese Subway System. 
BCSIA Discussion Paper 2002-4, ESDP Discussion Paper ESDP-2002-01, John F. Kennedy School of 
Government, Harvard University, February 2002, 3. 

°® Judith Miller, Stephen Engelberg, and William Broad, Germs: Biological Wepoans and America’s Secret War, 
(New York: Simon & Schuster, 2001), 152-153, 161. 
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by late 1994, and a newspaper story in early 1995 suggested Aum Shinrikyo involvement. ”° 
Nonetheless, law enforcement investigation was constrained. 


The Matsumoto incident alerted emergency responders, police, and physicians that another 
sarin attack was possible or even likely to occur. Timely information sharing and 
interdependence would be key in any future incident. At least one physician who had treated 
patients in Matsumoto called hospitals in Tokyo on March 20, 1995 to alert them to the fact 
that the symptoms he was seeing on television matched those he had observed in the 
Matsumoto sarin exposure. He assisted hospital medical staff near the subway sites to a 
correct diagnosis of sarin attack. Similarly, a hospital involved in the Matsumoto incident 
faxed information about sarin treatment to the hospitals in Tokyo. As the news reports 
provided live coverage of the Tokyo victims, a Japanese manufacturer of a critical medicine 
for treatment took the initiative to send a supply of the item to Tokyo without waiting for a 
government request.” 


The use of a chemical weapon in a terror attack complicates the issues of public safety and 
emergency response. Issues and actions can quickly compound when chemical agent use is 
suspected. Special care medical facilities must be established, protection of first responder 
personnel must be 
adequate and timely; 

secondary 
contamination of 
people, equipment, and 
facilities must be 
limited; and anxiety 
can erupt into chaos 
once a chemical agent 
is confirmed. During 
the Tokyo - sarin 
attack, over 5000 
people arrived at 
hospitals, but only 
about 20 percent of 


those people 
Figure 1-8. Emergency Response at Tokyo Subway displayed symptoms 
(Source: ) of sarin poisoning.”' 


For the Tokyo attack, 
Japanese Self Defense 
Forces were the only organization with decontamination expertise. Yet, the role of this 
military force was primarily limited by protocol to the decontamination of the trains after 


»° Tbid., 14. 

°° Nerve Agent: GB (Sarin), 11. available from http://cbwinfo.com/Chemical/OPNerve/GB.shtml; Internet; 
accessed 14 February 2005. 

°! Dana A. Shea, Terrorism: Background on Chemical, Biological, and Toxin Weapons and Options for 
Lessening Their Impact, RL 31669 (Washington, D.C.: Congressional Research Service Report for Congress, 1 
December 2004), 5 and 6; available from http://www.fas.org/irp/crs/RL31669.pdf; Internet; accessed 7 January 
2005. 
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incident recovery operations were complete.°* Within two hours of the subway attack, several 
Japanese military experts arrived at Tokyo hospitals to advise and assist on patient treatment.” 


A recent Central Intelligence Agency report states that terrorist attacks in the future would 
likely be “small-scale, incorporating improvised delivery means, or easily produced or 
obtained chemicals, toxins, or radiological substances.”°** Small-scale chemical weapons can 
be a weapon-of-choice by terrorists given the sure knowledge of the anxiety and other 
psychological stress the attack threat or use can produce. Health concerns by the general 
population include the awareness that attack can occur without warning; knowledge that a 
deliberate terrorist decision, rather than a natural disaster, can cause the attack; incomplete or 
unfamiliar information of actual health threats can increase anxiety, as can the potential long- 
term effects of a chemical weapon on current or future generations.” 


Some senior U.S. Defense Department leaders believe that WMD attack against civilian 
populations or military forces and infrastructure is a consideration of “when” rather than a 
possibility of “if” terrorists will use chemical or other means of WMD. 


“,..they [terrorists] inevitably will get their hands on them [weapons of 
mass destruction] and they will not hesitate to use them.”°° 


Honorable Donald Rumsfeld 
U.S. Secretary of Defense 
2002 


A separate study by the Office of the Secretary of Defense assessed the potential for a 
chemical attack to cause significant delays in the deployment of military forces and to 
negatively impact on mission success. Findings indicate that significant delays in force 
projection could occur and mission conduct could be impaired.*” 


Whether the terrorist target is a civilian or military population and infrastructure, this case study 
provides insight to the multi-dimensional requirements to combat terrorism that include 
international and national policy and law enforcement issues, intelligence constraints and 
restrictions in a democratic society, use of military forces in consequence management support of 
a catastrophic chemical incident, intergovernmental emergency response preparation and 
readiness, and public awareness of the terrorist and WMD threat. 


°° Pangi, Consequence Management in the 1995 Sarin Attacks on the Tokyo Japanese Subway System, 39. 

53 Nerve Agent: GB (Sarin), 11; available from http://cbwinfo.com/Chemical/OPNerve/GB.shtml; Internet; 
accessed 14 February 2005. 

°4 Terrorists Interested in Unconventional Weapons, CIA Says, November 23, 2004; available from 
http://www.usembassy.it/file2004_/alia/a4112901.htm and 
http://www.cia.gov/cia/reports/721_reports/july_dec2003.htm; Internet; Accessed 7 January 2005. 

°° Interallied Confederation of Reserve Officers, “The Effects of Terrorist Attacks and Threats on the Well being 
of People,” DEF SEC COM Terrorism Study task Force, 29 July 2003, 2. 

°° Dana A. Shea and Frank Gottron, Small-scale Terrorist Attacks Using Chemicals and Biological Agents: An 
Assessment Framework and Preliminary Comparisons, 6. 

87 Theodore Karasik, Toxic Warfare, RAND Project Air Force, Contract F49642-01-C-0003, 2002, 33. 
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Note: What is sarin? See the Federation of American Scientists (FAS) fact sheet “Chemical 
Agent Fact Sheet — Sarin” appended to this case study. This one-page display provides a 
definition of sarin and overview of delivery means, production, historical use, function, 
effects, medical treatment, and other “quick facts.” 


FAS Federation of American Scientists 


Chemical Agent Fact Sheet—Sarin 


° 
Sarin is a colorless, odorless, tasteless, human- 


made chemical warfare agent. It was originally Quick Facts 

developed in Germany in the 1930's as a pesticide. 

Sarin is a nerve agent—it disrupts the functioning of Agent Type: Chemical nerve agent 

the nervous system. Nerve agents are the most toxic - 

and rapidly acting of all heme chemical warfare Leen: ik ee 
agents. Sarin is highly toxic in both its liquid and Treatment: Antidote, if administered quickly 
PP ate Status: CDC Nerve Agent 


Delivery: Inhalation, ingestion, absorption 


Mechanism: Sarin disrupts the ability of the body to 
regulate nerve impulses. When this happens, the glands 
and muscles of the body are continually stimulated, 
leading to system fatigue. The victim will lose control 
over his bodily functions. Ultimately, the victim will fall 
into a coma and suffocate. 


Military gear worn to protect against sarin 


Effects: The first signs of sarin exposure are a runny 
nose, tightness in the chest, pinpoint pupils, eye pain, 


Delivery: Following release into the air, people and blurred vision. The victim will then experience 
can be exposed to sarin through contact with skin or drooling, excessive 
eyes. Sarin can also be inhaled as a gas. Sarin mixes sweating, coughing, 
easily with water, and since it is odorless, people chest pain, diarrhea, 
would not be aware of sarin in drinking water. increased urination, 
Furthermore, sarin in water can be absorbed through confusion, drowsiness, 
the skin. weakness, headache, 
a 9 nausea, and vomiting. 
Production: Sarin is made by mixing several ACH, Exposure to large doses 
commercially available chemicals in the right He of sarin will result in 


amounts and in the right sequence. It is debatable Molecular structure of sarin* loss of consciousness, 
how easy it is for the layperson to synthesize sarin. It 


‘ P involuntary twitching and jerking, paralysis, coma and 
is somewhat complicated and dangerous to produce. ry Saad eae pate yers 


eventually, death. 


Historic Use: Iraq used sarin in the 1980-1988 
war with Iran. The Japanese religious sect, Aum 
Shinriko, released sarin in Matsumoto in 1994 and pages : 5 ; ; 
the Tokyo subway in 1995. In May 2004, the effective. Clothing can retain satin, so it must be 
presence OF satin was detected in the debris ofa removed. The victim should move quickly to fresh air. 


p As quickly as possible after exposure, the victim 
bomb that exploded in Iraq. should wash thoroughly with soap and water. 


Treatment: There are antidotes to sarin, but they 
must be provided very soon after exposure to be 


(Sources: CDC, U.S. Army, WITO) 
*National Library of Medicine 


For further information contact SUEPITANIE LORANGER, Ph.D, Biology Issues Director, SLORANGIER @tas.org, 202-454-4686 
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Chapter 2: Murrah Federal Building Bombing 


The truck bombing of the Murrah Federal Building in Oklahoma City, Oklahoma, on April 
19, 1995, signaled a horrific escalation of domestic terrorism conducted in the United 
States homeland. 


“This is the place, after all, where terrorists don’t venture. The 
Heartland. Wednesday [April 19] changed everything.” 


The Daily Oklahoman 
April 20, 1995 


This act of domestic terrorism highlights the importance of accurate and timely intelligence 
on potential terrorist activities and capabilities, while preserving the individual rights and 
liberties of our democracy. The shock of this devastating attack was much more than physical 
damage. The psychological impact, both near-term and long-term, propelled each United 
States citizen into a stark recognition that domestic terrorism truly exists within the nation’s 
borders. This example of terrorism in a contemporary operational environment illustrates an 
emergent terrorist trend of mass casualty or mass destruction effects as a terrorist objective. 


Figure 2-2. Below, FBI Forensic 
Sketch and Photograph of 
Timothy McVeigh 


McVeigh was convicted 
for the bombing of the 
Murrah Federal Building. 


He was executed June 11, 2001. 


Figure 2-1. Above, Overhead View of Murrah Building Damage” 


°° Department of Justice, Office of Justice programs, Office for Victims of Crime, Responding to Terrorism 
Victims (October 2000), ix, by Kathryn M. Turman, Director; available at 
http://www.ojp.usdoj.gov/ovc//publications/infores/respterrorism/welcome.html; Internet; accessed 11 March 
2004. 

°° Photo Image; available at http://www.fbi.gov/hq/lab/org/ipgu.htm; Internet; accessed 11 March 2004. 
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This incident was, ultimately, the wanton act of one person. This case study presents an 
unclassified summary of a calculated strategy and tactics for a specific terrorist act based on 
U.S. findings in the criminal prosecution of Timothy McVeigh and his co-conspirator. 


A primary underlying aim of terrorism is a demoralizing psychological effect on a target 
population and leaders to erode resolve and enhance other terrorist objectives. This was 
clearly McVeigh’s goal when he selected a government target in the “heart of America.” 


Introduction 


The U.S. Department of Justice provided a concise summary on physical effects and 
casualties of the bombing. The blast at the Alfred P. Murrah Federal Building killed 167 men, 
women, and children and injured 853 others. A volunteer nurse became the 168" fatality 
when she was struck by falling debris during the emergency response. The explosion 
devastated downtown Oklahoma City. The blast reduced the north face of the Murrah 
Building to rubble, and caused extensive damage to each of the nine floors as they collapsed 
into the center. When the dust cleared, one-third of the building lay in ruins. The force of 
the blast damaged 324 surrounding buildings, overturned automobiles, started fires, 
shattered windows, and blew out doors in a 50-block area. News reports indicated that the 
blast was felt 55 miles from the site and registered 6.0 on the Richter scale. 


Nineteen children died and thirty children were orphaned in the Murrah Building’s collapse. 
More than 400 individuals were left homeless in the area. When the bomb detonated, about 
600 Federal and contract employees and about 250 visitors were in the building. Additionally, 
7000 people lost their workplace. Approximately 16,000 people were in the downtown area in 
Oklahoma City at the time of the explosion. Beyond the physical devastation and death or 
injury to initial victims, the terrorist attack caused significant psychological and emotional 
impacts on a much larger population.” 


Learning Objectives 


Learning objectives focus on analyzing case study information in order to synthesize and 
evaluate the insight of reflective experiences, discern patterns of terrorist method and means, 
and determine likely trends in future terrorist activities. Comparing and contrasting 
conditions, circumstances, and options available to the terrorist will enhance the ability to 
recognize vulnerabilities and identify threats. 


The objectives for this case study are: 
e Describe intelligence indicators that would have alerted law enforcement to the threat. 


e Understand the motivation of Timothy McVeigh for choosing the Murrah Building as a 
terrorist target of high value, as well as his selection of a symbolic date for the attack. 


”° Photo Image; available at http://www.hq.usace.army.mil/cepa/pubs/aug01/murrah.jpg; Internet; accessed 11 
March 2004. 
”! Turman, Department of Justice, Responding to Terrorism Victims, 1. 
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e Recognize the domestic terrorist threat to U.S. forces and citizenry in the United 
States homeland. 


e Explain the terrorist organizational structure and tactics, techniques, and procedures (TTP) 
used for the Murrah Building bombing. 


e Deduce a trend for terrorist acts with the objective of an increased combination for mass 
casualties and mass destruction. 


“Terrorism has now exploded into middle America.””” 


Louis J. Freeh 
Director 
Federal Bureau of Investigation 


Case Study Overview - Murrah Federal Building (1995) 


At 9:02 the morning of April 19, 1995 a catastrophic explosion ripped the air in downtown 
Oklahoma City. A truck bomb instantaneously demolished the entire front of the Alfred P. 
Murrah Federal Building. Tons of crashing concrete and metal disrupted governmental 
functions and destroyed scores of lives. These innocent Americans included clerks, 
secretaries, law enforcement officers, credit union employees, citizens applying for Social 
Security, and children.”* 


The Alfred P. Murrah Federal Building was used by various agencies of the United States, 
including the Agriculture Department, Department of the Army, Defense Department, Federal 
Highway Administration, General Accounting Office, General Services Administration, 
Social Security Administration, Housing and Urban Development, Drug Enforcement 
Administration, Labor Department, Marine Corps, Small Business Administration, 
Transportation Department, United States Secret Service, Bureau of Alcohol, Tobacco, and 
Firearms and Veterans Administration.“ 


” Louis J. Freeh, Director, Federal Bureau of Investigation; Congress, House of Representatives; Committee on 
the Judiciary Subcommittee on Crime; Opening Statement Before the Committee on the Judiciary Subcommittee 
on Crime, 104th Congress, 3 May 1995, 2; available from http://www.lectlaw.com/files/cur13.htm; Internet; 
accessed 5 March 2004. 

3 U.S. District Court, District of Colorado. Criminal Action No. 96-CR-68. United States of America, Plaintiff, 
vs. Timothy James McVeigh, Defendant. The McVeigh Trial’s April 24, 1997 Opening Statement by the [U.S.] 
Government; 3; available from http://www.lectlaw.com/bomb.html; Internet; accessed 5 March 2004. 

74US. District Court, Western District of Oklahoma. Case No. M-95-105-H, United States of America, Plaintiff, 
vs. Terry Lynn Nichols, Defendant. “Terry Nichols Criminal Complaint,” Affidavit; 1995, 2; available from 
http://www. lectlaw.com/files/cur18.htm; Internet; accessed 16 February 2004. 
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The primary preparation for this criminal act began on or about September 13, 1994 and 
culminated on April 19, 1995 in the bombing of the Alfred P. Murrah Federal Building in 
downtown Oklahoma City, Oklahoma.” 


A chronology of terrorist activities displays an obsessive hate for the U.S. government, and a 
deliberate methodology for planning, preparing, and executing this terrorist attack. 


Background 


Surveying the lifestyle of Timothy McVeigh in the years prior to the bombing, he experienced 
mixed success at a series of minor jobs. He worked at a fast food restaurant in the fall of 1986 
until the spring of 1987. Then he switched jobs and went to work as an armored car driver for 
a commercial security company in Buffalo, New York from the spring of 1987 to the spring 
of 1988. 


McVeigh joined the U.S. Army in May, 1988 and remained in the Army until late 1991. He 
was a successful gunner on a mechanized infantry vehicle during the Gulf War and was 
decorated with several Army awards for actions in combat and commendable service. ”° Yet, 
McVeigh's dislike for the Federal government was revealing itself in this same period. Some 
of his discussions with acquaintances related to reading a book and the exploits of a group of 
well-armed men and women who called themselves "patriots" that sought to overthrow the 
Federal government by use of force and violence. In one book, a group makes a fertilizer 
bomb in the back of a truck and detonates it in front of a Federal building in downtown 
Washington, D.C. during business hours that kills hundreds of people.” 


As a guard for a commercial security company, he distributed white supremacist pamphlets 
and a book to co-workers on how to avoid paying taxes, and commented that it would be easy 
to steal firearms from a military base.”” From March 1992 to early 1993, McVeigh worked at 
another commercial security service. He visited his friends Mike and Lori Fortier who lived in 
Arizona. McVeigh worked at a hardware store in Arizona, and also worked as a security 
guard. Eventually, he started buying and selling books, as well as survivalist items at 
numerous gun shows throughout the United States. 


McVeigh was fixated on personal rights and individual freedom. He studied history, the U.S. 
Constitution, and the amendments to the Constitution. He carried them on his person, he 
carried them in his car, and he carried them in his briefcase. He stacked them in his house, 
and he displayed them on tables at gun shows. 


”° U.S. District Court, District of Colorado. Criminal Action No. 95-CR-110 United States of America, Plaintiff, 
vs. Timothy James McVeigh and Terry Lynn Nichols, Defendants. “8/95 Grand Jury Indictment of McVeigh 
and Nichols,” Indictment Count One (Conspiracy to Use a Weapon of Mass Destruction); 1995, 1; available 
from http://www.lectlaw.com/files/cas44.htm; Internet; accessed 2 February 2004. 

® U.S. District Court, District of Colorado. Criminal Action No. 96-CR-68. United States of America, Plaintiff, 
vs. Timothy James McVeigh, Defendant. The McVeigh Trial’s April 24, 1997 Opening Statement by the 
Defense; 5 and 6; available from http:/Awww.lectlaw.com/bomb.html; Internet; accessed 5 March 2004. 

” U.S. District Court, District of Colorado. Criminal Action No. 96-CR-68. Opening Statement by the [U.S.] 
Government; 6 and 7; available from http://www.lectlaw.com/bomb.html; Internet; accessed 5 March 2004. 

”° Lou Michel and Dan Herbeck, American Terrorist: Timothy McVeigh and the Oklahoma City Bombing (New 
York: Harper Collins Publishers Inc., 2001), 113. 


2-4 


TRADOC G2 Handbook No. 1.01, Terror Operations: Case Studies in Terrorism 25 July 2007 


He also wrote letters to newspapers with his viewpoint on personal rights and freedoms. He 
voted as a U.S. citizen. His politics were openly expressed and known to everyone that spent 
time with him.” In touring gun shows throughout the United States, he eventually visited 
forty of fifty states. As he sold books and survival items at gun shows, he often met people 
with similar concern about Constitutional rights and the perceived Federal government’s zeal 
in gun control.*” 


McVeigh viewed the Federal raid at Ruby Ridge in 1992 as another incident of government 
attack on individual freedoms. Incidents between U.S. citizens and Federal agents such as at 
Ruby Ridge [1992] and Waco [1993] greatly concerned McVeigh. Citizens could have 
distinctly different beliefs and commitment to how individual rights®' and obedience to and 
enforcement of law®’ are expressed in the United States. According to McVeigh’s defense 
attorney at his trial after the Murrah Building bombing, McVeigh was angry about Ruby 
Ridge. He believed that the ATF had entrapped Randy Weaver into committing a crime so 
that they could then pressure Weaver into being an informant for the ATF [Alcohol, Tobacco, 
and Firearms] in a community in northern Idaho. McVeigh believed that the Federal 
government had acted very unjustly in the incident that resulted in the death of a Federal 
agent, the killing of Randy Weaver's wife, and the killing of a ten-year-old boy as he was 
running towards the Weaver’s house. A court jury acquitting Randy Weaver of murder in the 
Ruby Ridge incident further convinced McVeigh of the correctness of his belief. 


McVeigh also strongly opposed to the Brady Bill and gun control, so he wrote angry letters 
and talked about freedom and citizen’s constitutional rights. In McVeigh’s mind, the Brady 
Bill was just the first step to effectively repeal the U.S. Constitution’s Second Amendment by 
taking away from people their right to own guns and to protect themselves against abuses of 
the Federal government. 


In addition to his concerns on the Ruby Ridge incident and the Brady Bill, McVeigh became 
obsessed with the outcome of the Waco, Texas incident between a religious group known as 
the Branch Davidians and Federal agents from the Bureau of Alcohol, Tobacco, and Firearms. 
An attempt to serve a search warrant for illegal weapons resulted in a gunfire exchange that 
resulted in several deaths and a group of Branch Davidians barricading themselves inside their 
ranch compound. He traveled to the Waco site and distributed anti-governmental literature. 
On April 19th, 1993, the United States experienced another tragedy when the siege of the 
Branch Davidian compound resulted in several deaths and destruction of the compound. 
McVeigh believed that the Federal government executed 76 people at Waco, including 30 
women and 25 children. He believed that the Federal law enforcement at Waco deployed in a 
military fashion against American citizens and children living as a religious group in a 


” U.S. District Court, District of Colorado. Criminal Action No. 96-CR-68. Opening 


Statement by the Defense, 8. 

8° Michel and Herbeck, American Terrorist, 121. 

8! “Ruby Ridge Federal Siege, Bibliography” [bibliography on-line]; available from 
http://users.skynet.be/terrroism/html/usa_ruby_ridge.htm; Internet; accessed 16 March 2004. 

82 «Waco — Branch Davidian Files,” available from http://www.paperlessarchives.com/waco.html; Internet; 
accessed 16 March 2004. 

8° U.S. District Court, District of Colorado. Criminal Action No. 96-CR-68. Opening Statement by the Defense, 9. 
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compound, who had committed no crime.** McVeigh visited Waco during the siege and went 
back after the compound’s fire and final events of the siege. 


As time passed, he became more outraged at the government. McVeigh told people that the 
U.S. Federal Government had intentionally murdered people at Waco, and described the 
incident as the government's declaration of war against the American people. He wrote letters 
declaring that the government had drawn "first blood" at Waco, and predicted there would be 
a violent revolution against the American government. 


McVeigh's anger and hatred of the government kept growing, and in late summer 1994, he 
told friends that he was done distributing antigovernment propaganda and talking about the 
coming revolution. He said it was time to take action, and the action he wanted to take was 
something dramatic, something that would shake up America [United States]. McVeigh 
expected and hoped that his action would be the “first shot” in a violent, bloody 
revolution in this country. © 


Planning and Preparation: Oklahoma City Target 


The action he selected was a bombing, and the building he selected was the Murrah Federal 
Building in Oklahoma City. McVeigh had two reasons for bombing that particular building. 
First, he thought that the ATF agents, whom he blamed for the Waco tragedy, had their 
offices in that building. Second, McVeigh described the Murrah Federal Building as “an 
easy target.”°° 


McVeigh selected the Murrah Building from a list of sites he developed as potential targets. 
He wanted his attack to target Federal law enforcement agencies and their employees. He 
recognized that many innocent people would be injured or killed. Primary targets included the 
Bureau of Alcohol, Tobacco, and Firearms; Federal Bureau of Investigation; and Drug 
Enforcement Administration. Besides the Oklahoma City site, McVeigh considered locations 
in Arkansas, Arizona, Missouri, and Texas. Another possible site may have included 
Washington, D.C. McVeigh considered targeting specific Federal individuals or their 
family members, but decided that a bombing would cause more notoriety.” 


The Murrah Building was conveniently located just south of Kansas where McVeigh resided. 
Its close proximity to an interstate highway (Interstate 35) assured easy access to and egress 
from the bombing target. The building design allowed for easy delivery or pickup of 
packages and people due to indented curbing in front of the building, which allowed vehicles 
to park directly in front of the building. You could drive a truck directly up to the front of the 
building.** McVeigh assessed the damage that would occur based on the extensive amount of 


®* U.S. District Court, District of Colorado. Criminal Action No. 96-CR-68. Opening 
Statement by the Defense; 8. 


* U.S. District Court, District of Colorado. Criminal Action No. 96-CR-68. Opening Statement by the [U.S.] 
Government, 7. 

°° Tbid., 8. 

87 Michel and Herbeck, American Terrorist,167 and 168. 

°° U.S. District Court, District of Colorado. Criminal Action No. 96-CR-68. Opening Statement by the [U.S.] 
Government, 9. 
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glass windows in the Murrah Building and considered the probable collateral damage to 
surrounding structures. He recognized that the open parking lot space across the street from 
the building may dissipate some concussion from the explosion, but would allow good 
photograph coverage of a stark, horrifying image. Killing a large number of Federal 
employees was part of his plan to ensure major media attention.” 


McVeigh conducted detailed personal reconnaissance of his target and routes of approach and 
routes of escape.” McVeigh memorized his sequence of actions for this bombing, 
rehearsed his route, and prepared mentally for contingencies such as flat tires or meeting 
with police." 


McVeigh practiced bomb construction and observed bomb effects on a small scale by using a 
plastic jug and detonating the explosive-packed device at a desert location near a friend’s 
home.” The bomb concept McVeigh was planning consisted of more than 5000 pounds of 
ammonium nitrate fertilizer mixed with about 1200 pounds of liquid nitromethane, 350 
pounds of Tovex explosive, and the miscellaneous weight of sixteen 55-gallon drums, for a 
combined weight of about 7000 pounds.” The truck bomb was relatively inexpensive to 
construct. A truck rental would be about $250. Fertilizer would cost about $500. The 
nitromethane cost about $3000. A used car for his escape vehicle would cost about $250. His 
estimate was a bomb project costing approximately $5000.” 


McVeigh and Nichols obtained 4,000 pounds — two tons — of ammonium nitrate fertilizer. 
They bought it at a farm supply store in central Kansas where Nichols was living at the time 
and where McVeigh visited him. This was in the fall of 1994, at least six months before the 
bombing; giving an indication of the deliberate planning that went into process and 
premeditation.” To get some of the other chemicals they needed for the bomb, McVeigh and 
Nichols used a commercial phone book and simply called dozens of companies and 
individuals in search of ingredients.”° 


McVeigh and Nichols got the detonators for the bomb by stealing them. Near Marion, 
Kansas, they broke into several storage lockers for explosives at a rock quarry, and stole 
hundreds of blasting caps and sausage-shaped explosives known as Tovex.” They rented 
storage lockers in the central Kansas area near Nichols home and in Arizona to store supplies 
and stolen items, using phony names to preclude easy tracing of their real identities.” 


During this period when McVeigh and Nichols were acquiring the components for the bomb, 
McVeigh periodically drove to Arizona and visited two of his friends, Michael and Lori 
Fortier. He had met Michael in the Army. They had shared similar antigovernment ideas, 


89 Michel and Herbeck, American Terrorist,168 and 169. 
*° Thid., 230. 

*! Tid., 214 and 215. 

* Thid., 165. 

* Thid., 164. 

* Tbid., 176 and 207. 

°° U.S. District Court, District of Colorado. Criminal Action No. 96-CR-68. Opening Statement by the [U.S.] 
Government, 9. 

°° Thid., 10. 

*” Thid., 13. 

° Tbid., 14. 
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and McVeigh had come to trust Michael and Michael's wife, Lori. In the fall of 1994, he 
confided his plan to both of them. Sitting in their living room in Kingman, Arizona, McVeigh 
drew a diagram of the bomb that he intended to build. He outlined the box of the truck and 
drew circles for the barrels inside the truck. He described how the barrels of fertilizer and 
fuel oil would be positioned in the truck to cause maximum damage. McVeigh demonstrated 
his design to Lori Fortier by taking soup cans from her cupboard and placing them on the 
floor. The layout displayed the shape of the bomb inside the box of the truck that he 
described as a shape charge. He explained that by putting the barrels of explosives in a 
particular shape, he would increase the blast effects in a particular direction.” 


In addition to what McVeigh told Fortier about his bombing plans, he took Fortier to 
Oklahoma City and showed him the building months before the bombing. McVeigh told 
Fortier during the trip that Nichols would help McVeigh mix the bomb and would help 
McVeigh get away after the bombing. When McVeigh and Fortier were in downtown 
Oklahoma City, they drove around the Murrah Building. McVeigh showed Fortier the alley 
where he planned on parking his car. He explained to Fortier that he would park there 
because he wanted to have a tall building between himself and the blast.'°° 


McVeigh also told Fortier about how he and Nichols planned to raise money to finance their 
illegal activities. They were going to do it by robbing a man who was a gun dealer that 
McVeigh knew from Arkansas. McVeigh had previously observed the man’s home in a 
remote area of Arkansas.'°' Since the man knew McVeigh, Nichols was going to do the actual 
robbery. The stolen weapons and property were eventually sold to finance the bombing plot. 


Table 2-1. Conspiracy Timeline for Murrah Building Bombing 


(“On or About Dates” ') 


Chronology 


September 22, 1994 McVEIGH rented a storage unit in the name of “Shawn Rivers” Herington, 
Kansas. 


September 30, 1994 McVEIGH and NICHOLS purchased forty fifty-pound bags of ammonium 
nitrate in McPherson, Kansas under name of “Mike Havens.” 

Late September 1994 McVEIGH made telephone calls in an attempt to obtain detonation cord and 

*° Tbid., 15. 

° Thid., 32. 

! Tid. 


10° U.S. District Court, District of Colorado. Criminal Action No. 95-CR-110 United States of 
America, Plaintiff, vs. Timothy James McVeigh and Terry Lynn Nichols, Defendants. “8/95 
Grand Jury Indictment of McVeigh and Nichols,” Indictment Count One (Conspiracy to Use a 
Weapon of Mass Destruction); 1995, 2 to 4; available from 
http://www.lectlaw.com/files/cas44.htm; Internet; accessed 2 February 2004. 
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October 1, 1994 


October 3, 1994 


October 4, 1994 


October 16, 1994 


October 17, 1994 


About 


October 18, 1994 


October 1994 


November 5, 1994 


November 7, 1994 


November 16, 1994 


November 21, 1994 


December 16, 1994 


Early 1995 


February 9, 1995, 


March 1995 


April 14, 1995 


April 14, 1995 


racing fuel. 


McVEIGH and NICHOLS stole explosives from a storage locker 
(commonly referred to as a magazine) in Marion, Kansas. 


McVEIGH and NICHOLS transported the stolen explosives to Kingman, 
Arizona. 


McVEIGH rented a storage unit in Kingman, Arizona for the stolen 
explosives. 


NICHOLS registered at a motel in Salina, Kansas under the name “Terry 
Havens.” 


NICHOLS rented storage unit No. 40 in Council Grove, Kansas in the name 
“Joe Kyle.” 


McVEIGH and NICHOLS purchased forty fifty-pound bags of ammonium 
nitrate in McPherson, Kansas under the name “Mike Havens.” 


McVEIGH and NICHOLS planned a robbery of a firearms dealer in 
Arkansas as a means to obtain moneys to help finance their planned act of 
violence. 


McVEIGH planned and NICHOLS robbed, at gunpoint, a firearms dealer in 
Arkansas of firearms, ammunition, coins, United States currency, precious 
metals and other property. 


NICHOLS rented storage unit No. 37 in Council Grove, KS in the name 
“Ted Parker” and concealed property stolen in the Arkansas robbery. 


NICHOLS rented a storage unit in Las Vegas, Nevada and stored items. 


NICHOLS prepared a letter to McVEIGH, to be delivered only in the event 
of NICHOLS' death, in which he advised McVEIGH, among other matters, 
that storage unit No. 37 in Council Grove, Kansas had been rented in the 
name “Parker” and instructed McVEIGH to clear out the contents or extend 
the lease on No. 37 by February 1, 1995. NICHOLS further instructed 
McVEIGH to "liquidate" storage unit No. 40. 


McVEIGH, while en route to Kansas to take possession of firearms stolen in 
the Arkansas robbery, drove with Michael FORTIER to the Alfred P. 
Murrah Federal Building and identified the building as the target. 


McVEIGH, NICHOLS, and FORTIER obtained currency from sale of 
firearms stolen in the Arkansas robbery. 


NICHOLS paid for the continued use of storage unit No. 40 at Council 
Grove, Kansas in the name of “Joe Kyle.” 


McVEIGH obtained a driver's license in the name of “Robert Kling” bearing 
a date of birth of April 19, 1972. 


McVEIGH purchased a 1977 Mercury Marquis in Junction City, KS. 


McVEIGH called the NICHOLS residence in Herington, Kansas from 
Junction City, KS. 
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April 14, 1995, McVEIGH called a business in Junction City using the name “Bob Kling” to 
inquire about renting a truck capable of carrying 5,000 pounds of cargo. 


April 14, 1995 McVEIGH rented a room at a motel in Junction City, KS. 
April 15, 1995 McVEIGH placed a deposit for a rental truck in the name "Robert Kling.” 


April 17, 1995 McVEIGH took possession of a 20-foot rental truck in Junction City, KS. 


April 18, 1995 McVEIGH and NICHOLS, at Geary Lake State Park in Kansas, constructed 
an explosive truck bomb with barrels filled with a mixture of ammonium 
nitrate, fuel and other explosives placed in the cargo compartment of the 
rental truck. 


April 19, 1995 McVEIGH caused the truck bomb to explode by lighting fuses connected to 
the explosive device in the truck. 


April 19, 1995 McVEIGH parked the truck bomb directly outside the Alfred 
P. Murrah Federal Building in downtown Oklahoma City, Oklahoma, during 
regular business and day-care hours. 


April 19, 1995 9:02 Truck bomb detonates next to Alfred P. Murrah Federal Building. 


McVeigh learned some of his bomb making knowledge from pamphlets or books easily 
available on the open market. He learned how to mix different explosive ingredients, how to 
set up the bomb; and details such as how to drill a hole between the cargo box and the 
cab of the truck so that he could light the fuse from where he would be sitting as he 
drove the truck bomb.” 


By the end of October 1994, McVeigh had most of the ingredients he needed to build the 
bomb. He was determined to take action when he thought it would have maximum impact. 
The anniversary of the tragedy at Waco would provide that kind of maximum impact. He 
thought that others in the U.S. were as angered at Waco as he was and that he could achieve 
tremendous impact — shake up the nation — by delaying his violent terrorist action until the 
April 19" anniversary of the Waco incident. 


“Something big is about to happen.” ” 


Timothy McVeigh 
Letter to McVeigh’s sister 


McVeigh had been regularly corresponding with his sister, Jennifer. In the fall of 1994, he 
visited her and created a file in her computer. He marked the file “ATF read,” as though he 
wanted the ATF to discover this file and read it after his dramatic action. One chilling 


103 Thid., 25. 
104 Thid., 15. 
10 Thid., 16. 
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declaration stated, “All you tyrannical [profanity] will swing in the wind one day for your 
treasonous actions against the Constitution and the United States.” The file entry concluded 
with these words: “Die, you spineless cowardice [profanity].” 


On occasion, McVeigh used pre-paid debit cards or public pay telephones to avoid the 
possibility of calls being traced to him. For instance, on April 14th McVeigh called Terry 
Nichols, who was living at that time in nearby Herington, Kansas. McVeigh also called a 
company to reserve a rental truck. Both calls were made on a debit card in an attempt to 
preclude any trace of who actually called. 


Later that day, McVeigh registered with his own name at a small motel in Junction City, 
Kansas. He resided at the motel through that weekend up until April 18th, Tuesday, the day 
before the bombing.'”° 


To hide his true identity, McVeigh used a phony driver's license to rent a truck. He had 
obtained a blank driver's license form through an advertisement in a commercial magazine 
that sells fake identification kits. He selected the name Robert Kling. As McVeigh noted to 
Lori Fortier, he liked that name because it reminded him of the “Klingon” warrior characters 
on a popular television show “Star Trek.”'”” 


Located about four miles from the motel, McVeigh arrived at a truck rental agency. The truck 
rental company attendant remembered a young man with a military demeanor who introduced 
himself as Robert Kling. Instead of simply making a cash deposit to reserve the truck in the 
name Kling, this man [McVeigh] wanted to pay for the truck in full. Kling [McVeigh] 
counted out several hundred dollars in cash and gave it to the attendant. After some 
administering of forms, Kling [McVeigh] departed the truck rental company, saying he would 
return to pick up the truck.'”° 


As a sidenote, April 23d is McVeigh's real birthday. However, the birthday he gave Kling on 
the fake driver’s license used to “prove” his identify was a special day -- April 19th -- the 
anniversary of the Davidian incident at Waco, and the date that McVeigh selected for the 
bombing in Oklahoma City.'” McVeigh wanted to avenge the deaths that occurred at 
Waco. He also knew that April 19th in 1775 is considered by some people as the beginning 
of the American Revolution'’® and in his own mind, would be symbolic of defiance against 
what he believed to be an oppressive government. 


On the morning of April 18, 1995, an individual at the Geary State Fishing Lake, 
approximately six miles south of Junction City, Kansas, observed a yellow truck parked next 
to a pickup truck for several hours. The individual described the pickup truck in some detail 
and recalled there was something white, possibly a camper shell, on the back of the pickup 


 Tbid., 19. 

‘7 Tbid., 17. 

' Tbid., 19-21. 

' Tbid., 24. 
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truck.''' Little did the observing individual know that two men (McVeigh and Nichols) were 
constructing a massive truck bomb that would devastate the Murrah Building the next day in 
Oklahoma City. 


The Attack with a High Yield Explosive 


Sleeping in the rental truck that night at a gravel lot near a roadside motel in northern 
Oklahoma, McVeigh awoke early the moming of April 19", 1995. As he entered downtown 
Oklahoma City, he placed earplugs in his ears and continued driving. He stopped briefly to 
light one of two fuses connected to the bomb. Shortly afterwards, he halted the truck for a 
stoplight and lit the second fuse. The Murrah Building and surrounding area, brimming with 
people, were about to become a macabre scene of devastation. 


McVeigh positioned the truck at the delivery access point in front of the Murrah Building, got 
out of the truck and locked the vehicle. He walked casually on a route along sidewalks that he 
had previously reconnoitered. He wanted to be behind a building when the bomb detonated. 
As the roar of the explosion shattered the morning air, McVeigh was lifted a full inch 
off the ground by the blast and recalled his cheeks being buffeted by the concussion. 
He didn’t look back. Within seconds, McVeigh was in his car and heading north out 
of the city.'” 


Supplemental Vignettes: The Immediate Aftermath 


After the bomb exploded, McVeigh calmly, at least outwardly, departed the bombing scene. 
McVeigh said he felt satisfaction of a mission accomplished. McVeigh had previously 
driven his car to Oklahoma City on Easter Sunday and prepositioned it near the Murrah 
Building as a means to depart the area after the bombing.’ Within seconds of the 
detonation, McVeigh was driving his car north out of the city.'' 


About an hour after the bombing, an alert Highway Patrol trooper driving on Interstate 35 
stopped a Mercury Marquis automobile because there was no car license plate on the back of 
the vehicle. He asked the driver (McVeigh) for his driver's license, and noticed a bulge under 
his clothing. McVeigh told the police officer that he had a loaded pistol and cooperated with 
the police officer as he was arrested. Yet, certain actions are puzzling about McVeigh. His 
post-trial reflections recount his thoughts when approached by the state trooper as McVeigh 
waited in his car by the side of the highway. McVeigh could have easily surprised and 
harmed the state trooper with a loaded pistol he was carrying on his person, but he chose not 
to do anything aggressive. At the time, the police officer made no connection with the 
bombing in Oklahoma City and McVeigh. He put McVeigh under arrest and drove to the 
county seat. 


1 U.S. District Court, Western District of Oklahoma. Case No. M-95-105-H, “Terry Nichols Criminal 
Complaint,” 6. 

1!2 Michel and Herbeck, American Terrorist, 220, 229-232. 

113 U.S. District Court, District of Colorado. Criminal Action No. 95-CR-110 United States of America, 20. 

114 Michel and Herbeck, American Terrorist, 232, 237. 

"S U.S. District Court, District of Colorado. Criminal Action No. 96-CR-68. Opening Statement by the Defense, 
42. 
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On April 21, 1995, investigators learned that at approximately 10:20 a.m. on April 19, 1995, 
Timothy McVeigh had been arrested in Oklahoma on traffic and weapon offenses, and was 
incarcerated on those charges in Perry, Oklahoma. McVeigh's arrest occurred approximately 
60-70 miles north of Oklahoma City, Oklahoma, approximately one hour and 20 minutes after 
the April 19, 1995 bomb explosion.''® 


Inside McVeigh's car, law enforcement agents later found a large sealed envelope. It 
contained writings, magazines, and photocopies from magazines and from newspapers that 
indicate McVeigh's motivation, and premeditation. Other documents that McVeigh had with 
him on this day of the bombing describe the value of killing innocent people for a cause. One 
excerpt — as highlighted by McVeigh — “The real value of our attacks today lies in the 
psychological impact, not in the immediate casualties.” Another slip of paper that he had in 
that envelope in his car read, in part, ”When the government fears the people, there is liberty.” 
And hand-printed beneath those printed words, in McVeigh's handwriting, are the words, 
“Maybe now there will be liberty.”'"” 


Fortier 


Fortier was culpable in the bombing. Although he did not join the conspiracy and he didn't 
participate in the bombing, he did have knowledge of McVeigh's plans. He neither reported it 
to anyone who could have stopped it, nor made any effort to prevent the criminal acts. 
Additionally, Fortier participated with McVeigh in transporting guns stolen from a gun dealer 
in Arkansas.''® 


Mr. Fortier agreed to enter a plea bargain, was found guilty by a jury trial, and sentenced to 12 
years in prison and fined $200,000.''” 


Nichols 


On April 21, 1995, at approximately 3:00 p.m., after hearing his name on the radio in 
connection with the Oklahoma City bombing, Terry Nichols voluntarily surrendered to the 
Department of Public Safety in Herington, Kansas. Herington authorities took no action and 
awaited the arrival of the FBI. Thereafter, a Special Agent of the FBI arrived and advised 
Nichols of his Miranda rights, which Nichols agreed to waive. '”” 


Although Nichols did not participate in the actual bombing, he was instrumental in assisting 
McVeigh in planning and preparing for the bombing. He helped rent storage lockers, purchase 
ammonium nitrate fertilizer and place McVeigh's get-away car in Oklahoma City. In a 


1© U.S. District Court, Western District of Oklahoma. Case No. M-95-105-H, “Terry Nichols Criminal 
Complaint,” 3. 

"U.S. District Court, District of Colorado. Criminal Action No. 96-CR-68. Opening Statement by the [U.S.] 
Government, 4 and 5. 

'8 Tbid., 34. 

"© «Oklahoma Bombing Chronology,” Washington Post, available from http://www.washingtonpost.com/wp- 
srv/national/longterm/oklahoma/stories/chron.htm; Internet; accessed 5 March 2004. 

° U.S. District Court, Western District of Oklahoma, Case No. M-95-105-H, “Michael Fortier’s Plea 
Agreement,” 3. 
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Federal Court, Nichols was convicted of conspiracy, and found guilty of involuntary 
manslaughter in the death of eight Federal officers. ‘7! 

After being found guilty in a Federal jury trial, Nichols was sentenced to life in prison without 
release for his role as the chief collaborator in the Oklahoma City bombing. In August 2004, 
Nichols was found guilty of murder on Oklahoma state charges. The District Judge ordered 
Nichols to serve life imprisonment without the possibility of parole. Nichols was spared the 
death penalty when the jury became deadlocked.'** 

McVeigh 

McVeigh was convicted on all 11 counts of his Federal Indictment, including conspiracy to 
bomb the building and responsibility for the deaths of eight Federal law enforcement officers 


killed inside.'”? Timothy McVeigh was executed at a Federal prison in Terra Haute, Indiana 
on June 11, 2001. 


Case Discussion Questions 


Intelligence and Threat Warning? 


What suspicious activities preceding the bombing attack might have indicated the tactical 
targeting of the Murrah building in an operational level U.S. intelligence estimate? 


Why did McVeigh select the Murrah Federal Building for his terrorist attack? 
Planning, Preparation, and Conduct? 


How did the terrorist cell obtain the major components of the improvised explosive device — 
the bomb? 


How did the terrorist and support cell structure itself, communicate, and operate during the 
phases of planning and execution of the Murrah Building bombing attack? 


How did the terrorist rehearse for the Murrah Building bombing? 


What does the proximity of distance of the Murrah Building to the point of bomb detonation 
indicate for force protection measures? 


"1 Richard A. Serrano, “Terry Nichols Sentenced to Life With No Hope of Parole,” Los Angeles Times, 
available from http://www.-tech.mit.edu/V118/N27/nichols.27w.htm; Internet; accessed 16 February 2004. 
se “Terry Nichols Gets Life, No Parole,” CNN.com LAW CENTER, 10 August 2004; available on 
http://www.cnn.com/2004/LAW/08/09/Nichols.sentence.ap/; Internet; accessed 25 August 2004. 

"23 Department of State, U.S. Department of State International information Programs, “Timothy McVeigh 
Executed for Oklahoma City Bombing,” 11 June 2001; available on 
http://usinfo.state.gov/topical/pol/terror/01061101.htm; Internet; accessed 16 February 2004. 
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Physical Site Vulnerabilities and Risk Assessment? 


What specific effects did the truck bomb detonation have on the structural integrity of the 
Murrah Building? 


Given the same type of truck bomb and the scenario of a multi-level downtown office 
building, how could terrorists have increased mass casualty effects and devastation? 


Assessment 


As the bombing in Oklahoma City makes clear, Americans — domestic terrorists - with 
dastardly aims and intentions such as McVeigh must be considered in any threats profile of 
the U.S. Homeland. Noted by the Director of the FBI, “We cannot protect our country, our 
way of life, our government and the democratic processes that ensure our freedoms 
and liberties if we fail to take seriously the threat of terrorism from all sources — 
foreign and domestic.” 


“Terrorism is best prevented by acquiring, through legal 
and constitutional means, intelligence information relating 
to groups and individuals whose violent intentions threaten 
the public or our nation’s interests.” ”” 


Louis J. Freeh 
Director 
Federal Bureau of Investigation 


McVeigh was a U.S. citizen with personal beliefs that festered into a growing mistrust and 
eventual hatred of the U.S. government.'”° 


Awaiting execution, McVeigh remarked, “I like the phrase ‘shot heard ’round the world,’ and 
I don’t think there’s any doubt the Oklahoma blast was heard around the world.”'”” 


A comprehensive FBI investigation determined that there was no larger conspiracy than 
McVeigh and Nichols in the Murrah Building bombing. Over 43,000 leads and over 7,000 
people were eliminated from consideration in this official scrutiny. No involvement of a 
foreign government or militia organization materialized, even though numerous allegations 
arose in conspiracy theories.'*® 


4 Touis J. Freeh, Director, Federal Bureau of Investigation; Opening Statement Before the Committee on the 


Judiciary Subcommittee on Crime, 3 May 1995, 2. 

5 Louis J. Freeh, Director, Federal Bureau of Investigation; Congress, House of Representatives; Committee on 
the Judiciary Subcommittee on Crime; Opening Statement Before the Committee on the Judiciary Subcommittee 
on Crime, 104th Congress, 3 May 1995, 3; available from http://www.lectlaw.com/files/cur13.htm; Internet; 
accessed 5 March 2004. 

126 Michel and Herbeck, American Terrorist, 108. 

7 Tbid., 382. 

8 Thid., 366. 
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In a May 1995 statement by the Director of the FBI, Mr. Louis Freeh stated, “I do not want 
my remarks to be interpreted as advocating investigative activity against groups exercising 
their legitimate constitutional rights or targeting people who disagree with our government. 
The FBI is entirely comfortable with the Constitution, due process rights, Congressional 
oversight, legal process, and the American jury system. They each protect the American 
people and the FBI...The FBI cannot and should not, however, tolerate and ignore any 
individuals or groups which advocate violence — which would kill innocent Americans, which 
would kill “America’s Kids.” They are not just enemies of the United States, they are 
enemies of mankind.” '”” 


'° Louis J. Freeh, Director, Federal Bureau of Investigation; Opening Statement Before the Committee on the 


Judiciary Subcommittee on Crime, 3 May 1995, 4. 
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Chapter 3: Khobar Towers VBIED Bombing 


The terrorist attack on Khobar Towers in 1996 highlights the importance of accurate and 
timely intelligence on terrorist activities and capabilities, the structure of a terrorist 
organization in action, and an emergent trend of mass casualty or mass destruction effects as a 
terrorist objective. This case study presents an unclassified summary of U.S. findings of 
intelligence shortfalls, force protection vulnerabilities, host nation operational sensitivities, 
and the calculated strategy and tactic of a specific terrorist act. In this case, a state sponsor 
assisted a surrogate group in order to influence U.S. policy in the Middle East. 


Figure 3-1. Above, Bomb Crater from VBIED 


(Source: U.S. House National Security Committee, Staff 
Report, The Khobar Towers Bombing Incident (1996).) 


Figure 3-2. Right, The Front View of Building 
131 at Khobar Towers After the Blast 


(Source: U.S. House National Security Committee, Staff 
Report, The Khobar Towers Bombing Incident (1996).) 
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Introduction 


The terrorist bombing of the Khobar Towers complex in Dhahran, Saudi Arabia on June 25, 
1996 exposed more than the physical vulnerability of Americans serving abroad. The attack 
exposed shortcomings of the U.S. intelligence apparatus that left Americans unprepared for 
the specific threat that confronted them. U.S. military organizations encountered significant 
internal problems of continuity and cohesion with the host nation while deployed for their 
mission. Risk increased for U.S. military members deployed on contingency operations where 
political and cultural sensitivities of the host country were significant factors.'”’ A chronology 
of terrorist group activities in this case demonstrates a dedicated motivation and deliberate 
planning and execution cycle that applied phases of reconnaissance and surveillance, specific 
target selection and refined surveillance, staging and rehearsal, attack, and escape. 


“Terrorism is a tool of states, a vehicle of expression for organizations and 
even a way of life for individuals. We can expect the terrorists to continue 
to seek out vulnerabilities and attack. Terrorists normally prey on the 
weak, but even militaries have vulnerabilities and present targets with 
high publicity value.” 


Honorable William J. Perry 
Secretary of Defense 
U.S. Department of Defense, 1996 


Learning Objectives 


Learning objectives focus on analyzing case study information in order to synthesize and 
evaluate the insight of reflective experiences, discern patterns of terrorist method and means, 
and determine likely trends in future terrorist activities. Comparing and contrasting 
conditions, circumstances, and asymmetric options available to the terrorist will enhance 
judgment to recognize vulnerabilities, identify threats, and minimize the ability of terrorism to 
impact on accomplishing a friendly force mission. 


The objectives for this case study are: 


e Describe intelligence indicators that might have created a more effective tactical estimate 
of terrorist intention and capability in the Khobar Towers bombing. 


e Understand the motivation of Saudi Hizballah and their state sponsor (Iran) associated 
support groups for choosing Khobar Towers as a terrorist target of high value. 


'8° House National Security Committee, Report on the Bombing of Khobar Towers (14 August 1996), by 


Chairman Floyd D. Spence and Report, U.S. House National Security Committee, Executive Summary; 
available from http://www.fas.org/irp/threat/saudi.pdf; Internet; accessed 10 February 2004. 

‘5! Department of Defense. Report to the President. The Protection of U.S. Forces Deployed Abroad (15 
September 1996) by Secretary of Defense William J. Perry, 14; available from 
http://www. fas. org/irp/threat/downing/report_f.html; Internet; accessed 18 February 2004. 
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e Recognize force protection vulnerabilities at Khobar Towers that terrorists optimized in 
the bombing attack. 


e Explain the terrorist organizational structure and tactics, techniques, and procedures (TTP) 
used for the Khobar Towers bombing. 


e Deduce a trend for terrorist acts with the objective of an increased combination for mass 
casualties and mass destruction. 


Case Study Overview — Khobar Towers Bombing (1996) 


Shortly before 10:00 p.m. on the evening of June 25, 1996, a driver and one passenger drove a 
Datsun automobile into a public parking lot adjoining Khobar Towers building 131. This car 
acted as a scout vehicle and parked in a far corner of the lot. Soon after, a white four-door 
Chevrolet Caprice entered the parking lot and was staged for later use as escape 
transportation. The terrorists in the Datsun signaled that all was clear by blinking its lights. 
With that signal, a fuel truck converted into a truck bomb with an estimated 3,000-5,000 
pounds of explosives approached the lot. The truck driver and his passenger entered the lot 
and backed the truck bomb against a perimeter fence in front of Khobar Towers building 131. 
After parking the truck, the truck driver and passenger quickly entered the back seat of the 
white Caprice. The Caprice, followed by the Datsun from the corner of the lot, sped away 
from the parking lot. Within minutes, the truck bomb exploded and devastated the north side 
of building 131, which was occupied by U.S. military members. The explosion killed nineteen 
U.S. military members and wounded 372 other Americans.'*” Many Saudi civilians and other 
third country citizens were injured in the attack. 


The force of the explosion was so great that the effects heavily damaged or destroyed six high 
rise apartment buildings and shattered windows in virtually every other structure in the 
compound, leaving a crater in the ground 85 feet wide and 35 feet deep. The blast concussion 
was felt 20 miles away in the Persian Gulf state of Bahrain. At the time, this incident was the 
worst terrorist attack against Americans in more than a decade.'”? 


Background 


From the 1980s and leading up to the Khobar Towers bombing, Hizballah, or “Party of God,” 
was the name used by a number of related Shia Islamic terrorist organizations operating in 
Saudi Arabia, Lebanon, Kuwait, and Bahrain. These Hizballah organizations were inspired, 
supported, and directed by elements of the Iranian government. Saudi Hizballah, also known 
as Hizballah Al-Hijaz, was a terrorist organization operating primarily in the Kingdom of 
Saudi Arabia. The group promoted, among other things, the use of violence against nationals 
and property of the United States located in Saudi Arabia. Because Saudi Hizballah was an 


' U.S. District Court, Eastern District of Virginia, Alexandria Division. Grand Jury Indictment of 46 counts 


against named and unspecified terrorists charged in the Khobar Towers bombing attack of 25 June 1996, 13; 
available from http://www.fbi.gov/pressrel/pressrel01/khobar.pdf; Internet; accessed 10 February 2004. 

'83 House National Security Committee, Report on the Bombing of Khobar Towers (14 August 1996), by 
Chairman Floyd D. Spence and Report, U.S. House National Security Committee, 1; Available from 
http://www.fas.org/irp/threat/saudi.pdf; Internet; accessed 10 February 2004. 
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outlaw organization in the Kingdom of Saudi Arabia, its members frequently met and trained 
in Lebanon, Syria, or Tran.14 


In the 1990s, Saudi Arabia witnessed growing dissatisfaction by large segments of its 
population as social, economic, and political issues approached crisis proportion within the 
kingdom. Not surprisingly, religion provided a powerful influence in each of these other 
areas. The Saudi population was growing at a rapid pace, expectations and quality of life 
experienced in previous years was no longer feasible for many Saudi citizens due to changing 
economic conditions, and many Saudis considered the Saudi royal family an apostate regime 
due to the close relationship with the United States. *° 


U.S. military presence in Saudi Arabia had been a contentious issue with many Saudis. Many 
Saudi citizens, and other people of the region with an Islamic fundamentalist viewpoint, were 
particularly critical of this non-Muslim presence in a country that is home to two holiest 
places in the Islamic religion, Mecca and Medina. This concern was part of a larger cultural 
struggle in Saudi Arabia. '”° 


Planning and Preparation 


Saudi Hizballah began surveillance of Americans in Saudi Arabia in about 1993. Surveillance 
and reports continued to flow among Saudi Hizballah and officials in Iran. Potential targets 
included the U.S. Embassy in Riyadh and locales where Americans lived and worked. By 
1994, Hizballah surveillance focused on eastern Saudi Arabia included Khobar Towers. In 
the months following, the terrorists recognized Khobar Towers as a lucrative target. The 
concentration of U.S. and coalition forces equated to between 2000 and 3000 people.'*” In 
mid-1995, terrorists began regular surveillance of Khobar Towers. Pre-attack surveillance 
was conducted with one vehicle. The vehicle was observed and reported ten times over 40 
separate occasions of surveillance. 


4 U.S. District Court, Eastern District of Virginia, Alexandria Division. Grand Jury Indictment of 46 counts 


against named and unspecified terrorists charged in the Khobar Towers bombing attack of 25 June 1996, 2; 
available from http://www. fbi.gov/pressrel/pressrel01/khobar.pdf; Internet; accessed 10 February 2004. 

'85 Joshua Teitelbaum and David Long, “Islamic Politics in Saudi Arabia,” The Washington Institute for Near 
East Policy, Policywatch: Special Policy Forum Report Number 259, 9 July 1997, 1 to 3; available at 
http://www. washingtoninstitute.org/watch/Policywatch/policywatch1997/259.htm; Internet; accessed 19 
February 2004. While Saudi Arabia attempted to balance modernization with its role as a protector of the holy 
places of Islam in the nation, U.S. military forces were an obvious secular presence in Saudi Arabia that 
offended many Saudi citizens. Aims of Islam and modernization were at odds. Disenchanted youth, ever 
increasing in size within the population, often vented their frustration with alliance or membership in radical, 
violent organizations. Young men recruited for the Saudi Hizballah would often be transported to Hizballah 
controlled areas in Lebanon for military training, weapons and explosives training, and indoctrination. 
Subsequent training and liaison occurred among terrorist members of the Saudi Hizballah and Lebanese and 
Iranian Hizballah organizations. Elements of the Iranian government sponsored forms of military training and 
other close association with terrorists. 

‘88 Alfred B. Prados, Congressional Research Service (CRS) Issue Brief for Congress, Saudi Arabia: Current 
Issues and U.S. Relations, 15 September 2003; Order Code IB93113, CRS-1. 

'87 U.S. Department of Defense. Report of the Assessment of the Khobar Towers Bombing (30 August 1996) by 
General (USA Retired) Wayne A. Downing, 16; available from 

http://www. fas.org/irp/threat/downing/unclf913.html; Internet; accessed 9 February 2004; Alain Gresh, “The 
unsolved mystery of a Saudi bomb attack,” Le Monde diplomatique, September 1997, 2; available from 
http://mondediplo.com/1997/09/saudi; Internet; accessed 19 February 2004. 
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By early 1996, the terrorists were identifying locations to hide explosives. Explosives were 
eventually hidden in the area surrounding Khobar for use in the bombing attack. Of note, an 
attempt to smuggle explosives for this attack into Saudi Arabia was discovered and foiled on 
March 28, 1996 as a terrorist attempted to cross the Saudi Arabian border in a car. Saudi 
authorities confiscated 38 kilograms of plastic explosives hidden in the car and arrested the 
driver. Subsequently, Saudi investigators arrested several other terrorists. Nonetheless, Saudi 
Hizballah replaced these terrorists in the cell by May 1996 to replace or cover for an original 
group member for this attack. Additional large amounts of explosives were covertly collected 
and hidden in the vicinity of Khobar. 


In early June over a two-week period, the terrorists used plastic explosives to convert a tanker 
truck into a bomb — a vehicle borne improvised explosive device (VBIED). Key members of 
the Saudi Hizballah and the attack cell met in Syria in mid-June 1996 to confirm tactical plans 
for the bombing. Early in the evening of June 25, 1996, the six members of the attack cell 


reviewed final preparations for the attack. Several hours later, Khobar Towers would become 
138 


a terrorist incident of major proportion against U.S. military forces in Saudi Arabia. 


The Attack with a VBIED 


On June 25, 1996, at 
approximately 10:00 p.m. 
Dhahran local time, a fuel 
truck laden with an 
improvised explosive device 
approached the northwest end 
of the Khobar Towers 
compound from the north 
and turned east onto 31st 
Street just outside the 
perimeter fence separating 
the compound from a public 
parking lot. The truck bomb 
had an estimated explosive 
power equivalent of 20,000 
pounds of TNT.'”? The truck, 
and a car that it was 
following, continued to travel Figure 3-3. Bomb Crater at Khobar Towers 


along the perimeter fence Note: Note the proportion of crater to individuals along rim. 
toward the northeast corner 


of the compound. 


8 Ibid. 12 and 13. 

'° U.S Air Force. Independent Review of the Khobar Towers Bombing, Part A (31 October 1996) by Lieutenant 
General James F. Record, 54; available from http://www.fas.org/irp/threat/khobar_af/recordf.htm; Internet; 
accessed 9 February 2004. 
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A U.S. military security guard, present at an observation site on the roof of Building 131, 
spotted the suspicious car and fuel truck as they continued to travel along the perimeter fence 
toward the eventual attack site. When the vehicles reached Building 131, they tumed left, 
pointed away from the building, and stopped. The fuel truck backed up into the hedges along 
the perimeter fence, about 80 feet from, and directly in front of Building 131. When two men 
emerged from the truck, quickly entered the car, and sped away, the U.S. military security 
guard radioed the situation to the security desk and began, along with the other two guards on 
the roof, to evacuate the building. 


Emergency evacuation procedures began for Building 131 as the three security personnel ran 
door to door, starting from the top floor and working their way down, knocking loudly on 
each door and yelling for the residents to evacuate. Three to four minutes after the truck had 
backed up against the perimeter fence, the bomb exploded, demolishing the entire front facade 
of the eight-story building. 


Timely action on the part of the guards, who had only been able to work their way down 
several floors of the building, saved the lives of many residents of Building 131. Many 
residents evacuating the building were located in the building stairwells at the moment of the 
explosion. Given the injury and death caused by glass and other flying objects caused by 
the blast, the stairwells were probably the safest place to be at the time of bomb detonation. 


However, the force of the blast destroyed building 131 and severely damaged five adjacent 
buildings. Most of the buildings in the U.S. occupied sector of the Khobar Towers complex 
suffered some degree of damage. Nineteen U.S. military members were killed with several 
hundred other people injured. Hundreds of Saudi and third country nationals living in the 
complex and immediate vicinity were also wounded. The bomb blast shattered windows 
throughout the compound and created a crater 85 feet wide and 35 feet deep. The blast was 
felt as far away as Bahrain, 20 miles to the southeast. 


U.S. intelligence experts concluded that Americans were the targets of the terrorists. Although 
injury and death were extensive, an even greater number of casualties might have occurred had 
the driver positioned the truck differently against the fence and if at least one row of concrete 
barriers [“Jersey” barriers of the kind used in construction and on U.S. highways] had not been 
present to absorb or deflect part of the blast away from the lower level of building 131. 


Senior leaders of the U.S. military unit, after consultation with engineers and investigators at 
the scene, concluded that this force protection measure helped to prevent the collapse of the 
lower floors of the building. Had the lower floors collapsed, the attack would have likely 
caused collapse of the entire building with a significantly larger number of casualties 
and fatalities. '“° 


According to the terrorist plan, attack leaders immediately departed the Khobar Towers 
area and Saudi Arabia using false passports. Two terrorists remained in Saudi Arabia in 
their hometown. No Khobar Towers terrorists were captured immediately following the 
VBIED attack. 


‘4° House National Security Committee, Report on the Bombing of Khobar Towers (14 August 1996), by 
Chairman Floyd D. Spence and Report, U.S. House National Security Committee, 1 and 2; available from 
http://www. fas.org/irp/threat/saudi.pdf; Internet; accessed 10 February 2004. 
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Figure 3-4. Below, Photograph of Khobar Towers After the Bombing 
(Source: Report to the President and Congress on Protection of U.S. Forces Deployed Abroad (1996).) 


Areas secupied By Us 
= Fenced Compound 


Figure 3-5. Above, Diagram Sketch of Khobar Towers and Bombing Site 
(Source: Report to the President and Congress on the Protection of U.S. Forces Deployed Abroad (1996).) 
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Supplemental Vignettes: The Immediate Aftermath 
Intelligence and Threat Warning 


The U.S. Consul General in Dhahran at the time of the bombing stated, “No one really 
thought anything was going to happen in Dhahran. ...[I] never had a piece of paper or anyone 
else outlining any particular threat.”'*' In general, the U.S. presence allowed themselves to 
assume what the likely threats were, even in an absence of solid intelligence. A type of 
“tunnel vision” emerged that precluded an awareness of terrorist attack plans that were 
significantly greater than anything estimated. 


The specific information U.S. officials in the region did have on terrorist capability consisted 
of evidence concerning the size of the 1995 car bomb terrorist attack in Riyadh that was 
equivalent to about 250 pounds of TNT, and numerous small pipe bombing incidents in 
nearby Bahrain. Senior U.S. officers in Saudi Arabia generally concluded that the upper limit 
of a terrorist bomb was no higher than what had been used in the 1995 car bombing. 
Likewise, the Saudis did not see terrorists using anything larger than the 1995 car bombing. 


Other professional assessments did not estimate the damage potential of a bombing with the 
effects of the 1996 attack on Khobar Towers. The Regional Security Officer (RSO) at the 
U.S. Embassy in Riyadh related that a representative of his office had visited Khobar Towers 
prior to the bombing and was satisfied that the existing stand-off distance was adequate even 
though it was 20 feet less than the desired 100 foot State Department standard for fixed 
facilities. The RSO indicated that they would not have questioned an 80-foot stand-off 
distance even if the known threat had included a 1,000-pound bomb. 


The Chief of the National Intelligence Support Team (NIST) in Riyadh indicated that they 
considered the threat to be a bomb the size of the one that exploded at Riyadh in 1995, 
“maybe 500 pounds but -- we never went above 1,000 pounds.” Additionally, the U.S. Consul 
General in Dhahran stated, “the thought of a 20,000 or even 5,000 pound bomb driving up 
was pretty inconceivable.”!”” 


U.S. intelligence did not predict the precise attack on Khobar Towers. Commanders did have 
warning that the terrorist threat to U.S. military members and facilities was increasing. DOD 
elements in the theater had the authority, but were not exploiting all potential sources of 
information. Suspicious activities should have received more scrutiny. Human intelligence 
(HUMINT), had it been available, is probably the only source of information that could have 
provided the tactical details of a terrorist attack. In fact, a DOD report following the attack 
stated that the U.S. intelligence community must have the requisite authorities and invest 
more time, people, and funds into developing HUMINT against the terrorist threat.'*° 


‘4. U.S Air Force. Independent Review of the Khobar Towers Bombing, Part A; Appendix 1, Comments 


Regarding the Downing Report (31 October 1996) by Lieutenant General James F. Record, 51. Available from 
http://www. fas.org/irp/threat/khobar_af/recordap.htm; accessed 9 February 2004. 
142 . 

Ibid. 50. 
‘U.S. Department of Defense. Report of the Assessment of the Khobar Towers Bombing (30 August 1996) by 
General (USA Retired) Wayne A. Downing, 6; available from 
http://www. fas.org/irp/threat/downing/prefuncl.html; Internet; accessed 10 February 2004. 
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Security Measures in Effect 


Although the U.S. intelligence community was providing coverage of terrorist and terrorist 
related activities, the intelligence support lacked in at least one key area. Intelligence did not 
provide timely tactical warning of the impending terrorist attack and the specific kind of 
attack on Khobar Towers. Yet, vulnerability analysis using general intelligence of threats 
resulted in improvements to physical security and force protection measures at Khobar 
Towers prior to the June 25, 1996 bombing. These actions did save lives and reduced injuries.'“* 


Much of the force protection concentrated on precluding penetration of the complex perimeter 
by a car, truck, or suicide bomb. The commander responsible for the Khobar Towers 
complex was very proactive and aggressive in implementing improved security measures. 
Many complementing security measures were enacted such as an increased threat condition 
awareness, physical barriers and serpentine driving control patterns at checkpoints, 
restricted off-base travel, inspection procedures for parcels and commercial deliveries, 
and procedures for unannounced or suspicious visitors.‘ In the months preceding the 
Khobar Towers bomb attack, over 130 new security measures were implemented.” 


The DOD task force report on the Khobar Towers bombing states a strong belief that “...to 
assure an acceptable level of security for U.S. forces worldwide, commanders must 
aggressively pursue an integrated systems approach to force protection that combines 
awareness and training, physical security measures, advanced technology systems, and 
specific protection measures tailored to each location. A comprehensive approach of common 
guidance, standards, and procedures will correct inconsistent force protection practices 
observed in the theater.” !*” 


Following the Khobar Towers terrorist attack, the U.S. Secretary of Defense directed a critical 
re-evaluation of U.S. force posture in the region, and empowered military commanders to 
examine mission tasks with force protection as an even more important consideration in its 
worldwide mission planning and operations. 


Physical Site Vulnerabilities and Risk Assessment 


Ten suspicious incidents, including four of possible surveillance, were reported by U.S. 
members in April, May, and June 1996. Many of the incidents were during the period of the 
Hajj. The Hajj, or pilgrimage to Mecca, is a central duty and one of the five pillars of Islam. 
However, U.S. military forces were concerned that this surge of thousands of worshippers 


“* U.S. Department of Defense. Report to the President. The Protection of U.S. Forces Deployed Abroad (15 
September 1996) by Secretary of Defense William J. Perry, 5, 11 and 12; available from 
http://www. fas. org/irp/threat/downing/report_f.html; Internet; accessed 18 February 2004. 

“° U.S Air Force. Independent Review of the Khobar Towers Bombing, Part A; Appendix 1, Comments 
Regarding the Downing Report (31 October 1996) by Lieutenant General James F. Record, 11; available from 
http://www. fas.org/irp/threat/khobar_af/recordap.htm; Internet; accessed 9 February 2004. 

“© U.S Air Force. Independent Review of the Khobar Towers Bombing, Part A (31 October 1996) by Lieutenant 
General James F. Record, 44 and 47; available from http://www.fas.org/irp/threat/khobar_af/recordf.htm; 
Internet; accessed 9 February 2004. 

“” U.S. Department of Defense. Report of the Assessment of the Khobar Towers Bombing (30 August 1996) by 
General (USA Retired) Wayne A. Downing, 5. 
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from around the world could be a likely period for extremist acts against U.S. presence in the 
vicinity of Islam’s holy places in Saudi Arabia. The suspicious incidents in the vicinity of 
Khobar Towers were investigated by the U.S. military, Saudi military, and Saudi local police. 
Nothing in the investigations indicated an attack on Khobar Towers was imminent. 


These incidents included one possible threat indicator — the suspected ramming of a “Jersey” 
barrier on the east perimeter of the Khobar Towers complex. Reported to Saudi authorities, 
they permitted U.S. military forces to secure the barriers by staking them into the ground. 
There were four incidents of possible surveillance, which were reported to local Saudi 
authorities for further investigation. These occurred on April 1, 4, 17 and 25, 1996, and all 
involved reports by U.S. military members of Middle Eastern men driving by the Khobar 
Towers compound, or parked and observing the compound. Of the five incidents, two were 
inconclusive and three were completely discounted. 


These incidents were discussed with the Saudis, who did not view them as threatening. They 
attributed the incidents of possible surveillance to natural curiosity on the part of Saudi 
citizens about the activities of Americans inside the complex perimeter. A parking lot existed 
just outside the northern perimeter of Khobar Towers. Saudis used this lot as part of a 
community recreational area and to visit a nearby mosque. During the month-long period of 
the Hajj, it was normal for many people to congregate in this area during evenings. Most of 
the reported incidents took place during this time, and this may have caused the Saudi police 
to dismiss them as non-threatening. The Saudis said they had undercover security personnel in 
the area and they were not concerned. '“° 


Host Nation Relationship 


Saudi Arabia, as the host nation, retained sovereignty both inside and outside the complex at 
Khobar Towers. Saudi Arabian authorities permitted U.S. military forces latitude in security 
measures within the installation, but any permanent change to facilities required Saudi 
approval. Security internal to the complex was a shared responsibility by U.S. forces, 
coalition forces, and Saudi Arabian military police. Security outside the fence was a 
Saudi responsibility.‘ This tenuous sharing of force protection and limited ability to 
optimize security measures between the host nation, U.S. military forces, and the U.S. 
State Department caused significant challenges in the risk management of the Khobar 
Towers complex. 


A January 1996 vulnerability assessment conducted by U.S. military forces identified the 
north perimeter fence area and the adjacent public parking lot as a significant weak point for 
three reasons: (1) the size and relative remoteness of the parking lot, (2) the visual obstruction 
that limits the ability of U.S. forces to identify an oncoming threat, and (3) access to the 
parking lot was uncontrolled and open to anyone. Recommendations included cutting back the 
vegetation, installing bollards (half buried steel pipes) connected by chain or cable along the 


8 U.S Air Force. Independent Review of the Khobar Towers Bombing, Part A (31 October 1996) by Lieutenant 


General James F. Record, 46 and 47; available from http://www. fas.org/irp/threat/khobar_af/recordf.htm; 
Internet; accessed 9 February 2004. 

4°'U.S Air Force. Independent Review of the Khobar Towers Bombing, Part A (31 October 1996) by Lieutenant 
General James F. Record, 41; available from http://www.fas.org/irp/threat/khobar_af/recordf.htm; Internet; 
accessed 9 February 2004. 
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easement on the Saudi side of the fence or along the sidewalk on the U.S. side of the fence, 
reinforcing the existing concrete barrier line with one-inch steel cable, and parking heavy 
vehicles along the fence to limit high speed penetration of the installation. The vulnerability 
assessment noted the increased cooperation between U.S. and local Saudi police, and noted 
that Saudi military members would coordinate with local civilian authorities to increase the 
uniformed police presence outside the northwest and northeast fence lines. 


An earlier 1995 vulnerability assessment addressed security measures to be taken around the 
perimeter fence, including the proper placement of concrete “Jersey” barriers, and removing 
or repositioning objects near the vegetation on the north perimeter to increase visibility. 
Comments noted successful efforts by the U.S. security police to establish liaison with the 
various local military and civilian police agencies and an increased willingness for 
cooperation between the U.S. military forces and local police." The Saudi government, 
recognizing the need for U.S. military forces in the region since the Gulf War (1990-1991), 
encouraged a very urban presence of U.S. military forces. The Saudi royal family attempted 
to lessen the irritation of many Saudi to a “foreign presence” so near the holy places of Islam 
while simultaneously allowing the staging of U.S. military and coalition forces in their 
country. This tacit Saudi government aim exhibited itself in a methodical yet lethargic 
process for bolstering physical security measures suggested by U.S. military forces. In 
another practical limitation in an urban setting, expanding Khobar Towers security perimeters, 
emplacing more barriers, and clearing vegetation and foliage for better visibility along 
perimeters was counter to Saudi goals of minimizing Saudi citizen contact with U.S. forces. 
Expanding security distances in the area of the eventual attack site at Khobar Towers would have 
infringed on Saudi citizen access to a parking lot and park area near a local mosque. 


Terrorist Tactics, Techniques, and Procedures 


The terrorists organized in a cellular structure for their command and control. The Saudi 
Hizballah recruited from primarily young men of the Sh’ite faith. Cell members participating 
in this terrorist bombing came primarily from the same region in eastern Saudi Arabia, and in 
many cases, came from the same hometown. Loyalties such as a common religious 
eamestness, family and social relationships, and general dissatisfaction with Saudi 
government policies created a strong bond among members of this small group within the 
Saudi Hizballah. All cell members sequenced through deliberate phases of recruitment, 
indoctrination, and military-like training by the Saudi Hizballah. 


Leaders, cadre, and supporters of this cell were focused on this particular mission and target. 
As anorm, interaction occurred usually between two to three cell members, but could involve 
up to six cell members with personal contact and oral exchanges. At times, written reports 
provided assessments and requirements. Occasionally, meetings and liaison occurred with the 
leader of the “military wing” of Saudi Hizballah or other Hizballah supporters. When three 
members of the cell were compromised and arrested by Saudi authorities during the 
preparation phase for the attack, replacement cell members were quickly assigned from the 
same hometown area. This change in cell members disrupted, but did not dismantle the attack 
plan. Compartmenting knowledge within the cell had benefited the terrorists as they 
proceeded with coordination meetings, received final guidance from Hizballah leaders, 


159 Thid. , 49 and 50. 
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and set a timeline in motion to conduct the attack with a massive truck bomb at 
Khobar Towers.?" 


As noted earlier in the case study, planning and preparation included extensive surveillance. 
Pre-attack surveillance used one vehicle, which was observed and reported ten times of 40 
separate uses as a surveillance means.’ Reports and meetings with senior leaders of Saudi 
Hizballah supported planning in detail such as verifying the accuracy of a map of Khobar or 
the rehearsal of transporting explosives from Lebanon to Saudi Arabia.'”” 


The DOD Task Force chartered to assess the Khobar Towers bombing estimated the bomb 
contained the equivalent of from 3,000 to 8,000 pounds of TNT, “most likely about 5,000 
pounds.” The Secretary of Defense commissioned a special study by the Defense Special 
Weapons Agency (DSWA). The DSWA report estimated the bomb was much larger with a 
likely yield of 20,000 to 30,000 pounds of TNT-equivalent.'** 


DSWA compared physical attributes of the Khobar Towers crater and blast with physical 
attributes of craters formed by vehicle bomb tests conducted under terrain conditions similar 
to those at Dhahran. DSWA determined that the “...’best’ estimate for the Dhahran yield 
would be 11.5 tons or 23,000 pounds of TNT-equivalent explosive.” DSWA compared the 
5,000-pound TNT-equivalent yield estimate against the physical information known about the 
Khobar Towers crater and the crater information generated by the vehicle bomb tests. DSWA 
found that the 5,000-pound value implausible because it “implies a cratering efficiency 
greater than that produced by any known conventional explosive.” DSWA's analysis of glass 
breakage from the Khobar Towers bombing resulted in an even larger estimated TNT- 
equivalent yield of 31,000 pounds. This figure was derived by plotting the actual number of 
windows broken at Khobar Towers on a computer-generated graph that depicts the number of 
glass patio doors that would be broken by the blast pressures generated by various TNT- 
equivalent yields. 


A peer review by a panel of outside experts concluded the “DSWA analysis credibly supports 
the conclusion that the explosive power of the bomb was in the 20,000 pounds of TNT 
equivalent class and probably larger.” The DSWA also noted that Building 133, located some 
400 feet from the blast, sustained major structural damage. The weight of the evidence 
supports the DSWA estimate as to the size of the explosive.'”” 


Terrorists recognize the media value of physical effects on a target but seek the psychological 
impact value of attack that often overshadows the act itself. The inability of enemies to 


°! U.S. District Court, Eastern District of Virginia, Alexandria Division. Grand Jury Indictment of 46 counts 
against named and unspecified terrorists charged in the Khobar Towers bombing attack of 25 June 1996, 3 to 12; 
available from http://www.fbi.gov/pressrel/pressrel01/khobar.pdf; Internet; accessed 10 February 2004. 
°° Department of State, Bureau of Diplomatic Security, State Department Diplomatic Security Surveillance 
Detection Program Course of Instruction [CD-ROM], (Washington, D.C., October 1999). 
°° U.S. District Court, Eastern District of Virginia, Alexandria Division. Grand Jury Indictment of 46 counts 
against named and unspecified terrorists charged in the Khobar Towers bombing attack of 25 June 1996, 7 to 9; 
available from http://www.fbi.gov/pressrel/pressrel01/khobar.pdf; Internet; accessed 10 February 2004. 
* U.S Air Force. Independent Review of the Khobar Towers Bombing, Part A (31 October 1996) by Lieutenant 
General James F. Record, 53; available from http://www.fas.org/irp/threat/khobar_af/recordf.htm; Internet; 
accessed 9 February 2004. 
»° Tid. 54. 
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challenge U.S. and allied military power directly will likely lead to their asymmetric use of 
force to deter U.S. initiatives, attack forward deployed forces, and attempt to drive a wedge 
between the United States and its coalition partners. Terrorist attacks are intended to weaken 
U.S. resolve to maintain a force presence in threatened regions and to influence U.S. public 
and congressional opinion. Asymmetric use of force could include employment of weapons of 
mass destruction. The target will be U.S. citizens. Creation of casualties, whether from 
attacks like the one on Khobar Towers or more discrete attacks designed to establish a pattern 
of insecurity and helplessness, allows an enemy to demonstrate U.S. vulnerabilities at 
overseas locations and achieve political aims through indirect means.'”° 


The Immediate Aftermath 


International media attention spotlighted the terrorist attack on U.S. military forces in the 
Kingdom of Saudi Arabia. Terrorists achieved objectives of notoriety with a worldwide 
audience and significant psychological trauma of mass casualties and horrific property 
damage. U.S. military forces suffered terrible injuries and loss of life; similar injuries and 
damage occurred to the surrounding Saudi community. U.S. military forces lost prestige 
when a compound considered relatively safe was easily attacked and devastated with a large 
bomb. The royal family of Saudi Arabia lost prestige because of its inability to prevent such a 
terrorist attack that affected Saudi citizens, civilians and government workers from other 
countries, and the U.S. military presence as their invited temporary guests. Regional and 
world attention weakened Saudi royal family prestige, from an Islamic perspective, due to the 
presence of a non-Muslim military force in its country of holy places for the Islamic faith. 


Case Discussion Questions 
Intelligence and Threat Warning? 


What suspicious activities preceding the bombing attack might have indicated the tactical 
targeting of the Khobar Towers complex in an operational level U.S. intelligence estimate? 


Security Measures in Effect? 


How did Saudi and U.S. force protection measures encourage the terrorists to select the 
Khobar Towers complex for attack? 


What does the proximity of distance of the Khobar Towers building 131 to the perimeter of 
the residential complex suggest in force protection vulnerabilities? 


Physical Site Vulnerabilities and Risk Assessment? 


Why did terrorists detonate the VBIED at the specific point of the Khobar Towers complex? 


6 U.S. Department of Defense. Report of the Assessment of the Khobar Towers Bombing (30 August 1996) by 
General (USA Retired) Wayne A. Downing, 5; available from 
http://www. fas.org/irp/threat/downing/unclf913.html; Internet; accessed 9 February 2004. 
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Given the same bomb (VBIED) and scenario of Khobar Towers, how could terrorists have 
increased mass casualty effects? 


Host Nation Relationship? 


How could the U.S. military unit chain of command and local Saudi security forces have 
cooperated more effectively in collective security of the Khobar Towers complex? 


What impact did the urban location of Khobar Towers and a Saudi government aim of 
minimizing Saudi citizen contact and visibility with U.S. military forces have in hampering 
progressive physical security measures? 


Terrorist Tactics, Techniques, and Procedures? 
Why did the terrorist group choose the Khobar Towers as a principal target in Saudi Arabia? 


How did the terrorist group structure itself, communicate, and operate during the phases of 
planning and execution of the Khobar Towers bombing attack? 


Assessment 


Intelligence gaps left the U.S. military organization and its leaders at the Khobar Towers 
complex largely unaware of the magnitude of the threat they faced. Intelligence support fell 
short in at least three ways. First, available intelligence was devoid of specific knowledge of 
terrorist and dissident activity inside Saudi Arabia. As a result, assessments were incomplete. 
Second, intelligence analysis did not examine vulnerabilities in the context of capabilities 
greater than those already demonstrated in the 1995 bombing in Riyadh. Formal threat 
assessments appear to have remained reactive to events. Third, intelligence assessments did 
not acknowledge their own limitations. They did not communicate a level of uncertainty that 
should have been appropriate considering the lack of specific knowledge available and the 
difficulty of understanding the complex environments of Saudi society. Based on such 
intelligence assessments, U.S. commanders in the theater of operations and in the region of 
Riyadh likely had a false sense of appreciating the level of threat they faced and the requisite 
level of security required to protect U.S. forces. 


Problems stemming from such intelligence failures were further complicated by the 
organizational and operational shortcomings of the U.S. military mission characterized and 
conducted as a temporary mission. The provisional U.S. organization lacked continuity, 
cohesion, and adequate personnel resources. In particular, short-tour rotations — where 10 
percent of the command was new to the theater every week — created an unacceptable level 
of unit instability. This constant turnover of people in duty positions placed a significant 
knowledge and coordination burden on officers and enlisted members of the command. The 
high turnover rate hampered any practical ability for U.S. military leaders to build a 
relationship of trust with their Saudi host. 


Deference to Saudi cultural sensibilities, religious concerns, and domestic political concerns 
discouraged U.S. commanders in the field from aggressively pursuing more expansive 
security measures. While important, consideration of host country cultural sensitivities or 
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domestic politics should not have allowed any compromise to protection of U.S. forces, 
particularly in regions where a growing threat of terrorism focused against Americans. 


The combination of situational factors resulted in terrorists being able to identify target site 
vulnerabilities, conceive a plan to attack a point of weakness, conduct methodical preparation, 
react to disruption of terrorist group membership, and effectively attack the designated 
target to achieve their objectives against the Saudi government and U.S. military forces. 


315 


TRADOC G2 Handbook No. 1.01, Terror Operations: Case Studies in Terrorism 25 July 2007 


This Page Intentionally Blank 


316 


TRADOC G2 Handbook No. 1.01, Terror Operations: Case Studies in Terrorism 25 July 2007 


Chapter 4: USS Cole Bombing 


The maritime attack on the USS Cole by two individuals in a small boat, loaded with 
explosives, demonstrated an effective means of terrorism against U.S. military forces. When 
the suicide terrorist attack occurred, the bomb explosion next to the ship caused 17 
crewmember deaths, wounded 39 other crewmembers, and seriously damaged the ship. Two 
terrorists were also killed in the explosion. 


The “boat bombing” of the USS Cole introduced a new tactic of terrorism attack against a 
U.S. warfighting ship in a contemporary operational maritime setting. This case study 
presents an unclassified summary of U.S. observations and findings of U.S. intelligence 
shortfalls, U.S. force protection vulnerabilities, U.S. and host nation operational 
sensitivities, and the calculated strategy and tactic of a specific terrorist act. 


Figure 4-1. Above, USS Cole After the Attack 
(Source: http://www.chinfo.navy.mil) 


Figure 4-2. Left, USS Cole (DDG 67) 
(Source: http://federalvoice.dscc.dla.mil) 


Terrorists have the luxury of searching for a single vulnerability. Timing and method are 
tools of terrorist choosing and further complicate risk management and force protection of a 
target selected by terrorists. A primary underlying aim of terrorism is a demoralizing 
psychological effect on the target population and its leaders, often with explicit media 
coverage of mass casualty or mass destruction effects, to erode resolve and enhance 
terrorist objectives. 
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Introduction 


The 12 October 2000 attack on USS Cole in the port of Aden, Yemen, took advantage of a 
seam in the fabric of U.S. efforts to protect naval forces during an “in-transit” phase of 
deployment. The USS Cole'’’ (DDG 67) is an Aegis missile equipped, Arleigh Burke class, 
destroyer. As a result of the attack, attention focused on implementing ways to improve U.S. 
policies and practices for deterring, disrupting, and mitigating terrorist attack on U.S. 
maritime forces in transit. 


U.S. military forces support engagement elements of both the National Security Strategy and 
the National Military Strategy. This means continuous transit of U.S. ships, aircraft and 
military units. U.S. military forces operate on land, in the air, and on the seas in a world 
environment characterized by unconventional and transnational threats. Sovereign waterways, 
the high seas, or even a temporary berthing site are all possible locations for maritime 
terrorism.’ Assessing a chronology of terrorist group activities verifies a dedicated 
motivation and deliberate planning and execution cycle that applied phases of reconnaissance 
and surveillance, specific target selection, staging and rehearsal, preparation, attack; and 
although this was a deliberate suicide attack, escape plans for terrorist support elements 
following the bombing. 


Learning Objectives 


Learning objectives focus on analyzing case study information in order to synthesize and 
evaluate the insight of reflective experiences, discern patterns of terrorist method and means, 
and determine likely trends in future terrorist activities. Comparing and contrasting 
conditions, circumstances, and asymmetric options available to the terrorist will enhance 
judgment to recognize vulnerabilities, identify threats, and minimize the ability of terrorism to 
impact on accomplishing a friendly force mission. 


The objectives for this case study are: 


e Describe intelligence indicators that might have created a more effective tactical estimate 
of terrorist intention and capability in the USS Cole bombing. 


e Understand the motivation of Yemeni extremists and their associated support groups for 
choosing the USS Cole as a terrorist target of high value. 


e Recognize U.S. vulnerabilities to force protection measures at the USS Cole refueling site 
that terrorists optimized in the bombing attack. 


'S? Raphael Perl and Ronald O’Rourke, “Terrorist Attack on USS Cole: Background and Issues for Congress,” 
Congressional Research Service, The Library of Congress, Order Code RS20721, 1, 30 January 2001; available 
from http://news.findlaw.com/cnn/docs/crs/coleterrattck13001.pdf; Internet; accessed 5 April 2004. 

‘88 Department of Defense, DoD USS Cole Commission Report (9 January 2001) by U.S. Army Gen. (Ret) 
William Crouch and U.S. Navy Adm. (Ret) Harold Gehman, open-file report, U.S. Department of Defense, 1 
(Washington, D.C., 9 January 2001); available at http://www.fas.org/irp/threat/cole.html; Internet; accessed 16 
February 2004. 
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e Explain the terrorist organizational structure and tactics, techniques, and procedures (TTP) 
used for the USS Cole bombing. 


e Deduce a trend for terrorist acts with the objective of an increased combination for mass 
casualties and mass destruction. 


Case Study Overview - USS Cole (2000) 


U.S. military presence in the Mideast region demonstrates regional engagement while U.S. 
air, sea, and land forces deter aggression by anyone who would threaten U.S. critical national 
interests. In 2000, USS Cole was proceeding to join a carrier battle group in the Gulf region 
that formed a key part of an immediate ready force. This began with the ship’s deployment 
from Norfolk on August 8". The trans-Atlantic Ocean crossing lasted until August 20" when 
the ship and crew started conducting operations in the Mediterranean Sea. These operations, 
along with several port visits, lasted from August 20th until October 9". Then, USS Cole 
transited the Suez Canal in order to conduct maritime operations in the northern Arabian Gulf 
in support of enforcing United Nations Security Council Resolutions. 


Yemen plays a key part in the ability for U.S. and coalition maritime forces to operate in the 
region. Yemen controls the eastern side of the Bab al Mandeb choke point at the southern end 
of the Red Sea, and is geo-strategically positioned approximately 1400 miles south of Suez 
and 1400 miles southwest of the Strait of Hormuz.'”° 


Given the pending 3300-mile movement from the Suez Canal to the Northern Arabian Gulf, 
USS Cole required refueling. According to U.S. Navy policy, an oiler [fuel ship] does not 
accompany a single ship during transits, so the decision was made that USS Cole would 
conduct a brief stop for fuel (BSF) in Aden, Yemen. 


The operational requirement to refuel necessitated the development of: (1) a force protection 
plan for the refueling operation at Aden, (2) a logistics request for husbanding services at the 
port, and, (3) a request for the necessary diplomatic clearances. USS Cole met these 
requirements and continued the route down the Red Sea entering the port of Aden on 
October 12". She moored to the starboard side of a refueling platform at 8:49 a.m. (local 
Yemen time). 


ma Tommy Franks, “General Tommy Franks Testimony on USS Cole” [database on-line] (Washington, D.C., 25 


October 2000); 5; available from http://www. fas.org/man/dod-101/sys/ship/docs/man-sh-ddg51-001025zd.htm; 
Internet; accessed 5 April 2004. 
‘© Tbid., 7. 
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Photo View 
Direction 


Bomb-making Site 
Suspected Launch Point 
Fueling Facilities 
Attack Site USS Cole 


Figure 4-3. Bomb Site and Aden Harbor 
(Source: http://www.lib.utexas.edu/maps/world cities/aden.jpg and 


Figure 4-4, Aerial View of Port at Aden 
(Source: http://www.chinfo.navy.mil/navpalib) 
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Background 


The U.S. Central Command (USCENTCOM) area of operations is a large, dangerous, and 
complex region, consisting of 25 countries, with over half a billion people from a variety of 
ethnic and religious backgrounds. The region is historically unstable, yet remains vital to U.S. 
national interests. It contains vast energy resources, key air and sea lines of communication, 
and critical maritime choke points. Economic and political disruptions can have profound 
global consequences. Sources of instability within the region include hegemony, terrorism, 
proliferation of weapons of mass destruction, and ballistic missiles. Conflict is a norm in 
this region. Between USCENTCOM forming in 1983 as a U.S. military command and 
the USS Cole bombing in 2000, USCENTCOM responded to crises on 23 occasions.'®" 


U.S. Navy ships began making brief stops for fuel at Aden in January 1999. The decision to 
go into Aden for refueling was based on operational as well as geo-strategic factors and 
included an assessment of the terrorist and conventional threats in the region. The Horm of 
Africa was in great turmoil in 1998, as exemplified by continuing instability in Somalia, the 
U.S. Embassy bombings in Kenya and Tanzania, an ongoing war between Ethiopia and 
Eritrea, and an internal war in Sudan. In December 1998, combat strikes were conducted 
against Iraq for non-compliance with UN Security Council Resolutions. As of December 
1998, 14 of the 20 countries in the USCENTCOM area of responsibility (AOR) were 
characterized as “High Threat” countries. 


Djibouti, which had been the U.S. Navy refueling stop in the Southern Red Sea for over a 
decade, began to deteriorate as a useful port because of the Eritrea-Ethiopia war. This war 
caused increased force protection concerns for our ships, as well as congestion in the port 
resulting in operational delays. 


Aden, Yemen was seen as a viable alternative for refueling operations. Although the terrorism 
threat is endemic in this region. While the intelligence community and USCENTCOM 
regularly monitored the threat situation of the region and locales, no specific threat 
information or warning for Yemen or Aden indicated a pending terrorist attack on a U.S. 
warship, however, since the U.S. Navy began refueling operations in Aden in January 1999, 
U.S. Navy ships had conducted 27 brief stops for fuel, two port visits, and one logistics visit 
without incident. Nonetheless, Yemen was acknowledged as a high threat environment.'™ 


Planning and Preparation — Maritime Bombing 


A U.S. Federal Indictment issued in May 2003, describes a primary timeline of terrorist 
planning and preparation in 1999 and 2000 for the October 2000 terrorist attack. A U.S. 
Federal grand jury indicted two Yemeni nationals for plotting the October 2000 attack on the 
USS Cole in the harbor of Aden, Yemen. The Indictment alleges that Usama bin Laden’s 
1998 fatwa authorizing the killing of Americans motivated the defendants to conduct the 
terrorist attack on the USS Cole. Although Usama bin Laden may not be linked to the 
specific direction of the USS Cole attack, several links exist among al Qaeda operatives 
and the terrorists in this attack. 


161 Thid., 4. 
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This Indictment charges Jamal Ahmed Mohammed Ali al-Badawi and Fahd al-Quso with 
various terrorism offenses, including murder of U.S. nationals and murder of U.S. military 
personnel. Badawi was also charged with attempting, with co-conspirators, to attack the U.S. 
destroyer USS The Sullivans in January 2000, while it was refueling in the port of Aden. The 
defendants, both alleged to be longtime al Qaeda associates, remain at large overseas. They 
had been in custody in Yemen until they escaped from prison in early 2003. 


The table in this case study displays a timeline and series of actions leading to the terrorist 
attack on the USS Cole. Although not known by U.S. authorities at the time of the USS Cole 
attack, terrorists had attempted to attack USS The Sullivans on January 3, 2000, while the ship 
was berthed for servicing in Aden Harbor. Terrorists loaded a boat with explosives and 
launched the boat from the beach. However, the attack was aborted when the boat sank under 
the weight of the explosives. The May 2003 Federal Indictment alleges that the terrorists 
salvaged the explosives, refit the boat, and began plotting another attack. 


Badawi was a key al Qaeda operative in Aden recruited by terrorists closely associated with 
Usama bin Laden. Badawi assisted in procuring safehouses in Aden for terrorists, obtained 
the attack boat, and provided the trailer and truck used to tow the boat to Aden harbor. Quso 
facilitated the plot to attack USS Cole and prepared to film the attack from an apartment on 
the hills overlooking Aden Harbor. Among several unindicted co-conspirators, one is Tafiq 
Muhammed Saleh Bin Roshayd Bin Attash, also known as Khallad, and Abdul Rahim 
Mohammed Hussein Abda Al-Nasheri, who are alleged to be veteran students and teachers in 
the al Qaeda terrorist camps in Afghanistan. Saif al Adel, a member of al Qaeda’s military 
committee, who allegedly participated in the planning of these attacks, is also indicted in the 
East Africa embassy bombing case. Badawi, at the direction of Khallad and Nasheri, went to 
Saudi Arabia, purchased a boat large enough to carry explosives, and a trailer and truck to tow 
the boat, and secured a safehouse in Aden to hide the boat until the attack. 


Raed Hijazi was the man in charge of terrorist training for the USS Cole attack. According to 
U.S. sources, Raed Hijazi is a former Boston [USA] taxi driver and an American citizen of 
Palestinian origin. Jordanian security officials link him as a close associate of Mohammed 
Abu Zubayda, a member of Bin Laden's inner circle. Hijazi was arrested in Syria at the end of 
2000 and later transferred to Jordan where he had been sentenced to death in his absence for 
involvement in Bin Laden's alleged millennium plot, which included targets in Jordan and the 
U.S. Some evidence exists that the suicide attack in Aden Harbor was originally planned as 
part of the al Qaeda millennium plot.'® 


According to the U.S. Federal Bureau of Investigation (FBI), Khalid al-Midhar, a hijacker 
aboard the plane that crashed into the Pentagon on September 11 had earlier been observed on 
a surveillance video in Malaysia meeting an unnamed man who is suspected of involvement 
in the USS Cole attack. According to Abd al-Karim al-Iryani, who was Yemen's prime 
minister at the time of the attack, “Khalid al-Midhar was one of the Cole perpetrators, 
involved in preparations...He was in Yemen at the time and stayed after the Cole bombing for 


163 « A ttack on the USS Cole,” Yemen Gateway [database on-line]; available from http://www.al- 
bab.com/yeman/cole1.htm; Internet; accessed 6 April 2004. 
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Aden Harbor appears conclusive. 


Table 4-1. Timeline for USS Cole Maritime Bombing 


Chronology 


Spring 1999 


Summer 1999 
Summer 1999 


Summer 1999 


Summer 1999 


3 January 2000 


3 January 2000 


4 January 2000 


January 2000 


Spring 2000 


Summer 2000 


164 Thid. 


“On or About Dates”! 


Event 


NASHERI?® enlists BADAWI” with a letter from KHALLAD'® to assist in 
a terrorist operation. 


BADAWI locates a residence in Aden that provides privacy. 
NASHERIT leases property in Aden for six-month period. 


NASHERI directs BADAWI to procure a boat and a truck to tow the boat to 
Aden Harbor. 


NASHERI and other individuals secure a boat on the property. 


NASHERI and other individuals transport an explosives-laden boat from the 
property to the Aden Harbor beachfront. 


NASHERI and other individuals launch an explosives-laden boat with 
intention of bombing USS The Sullivans in Aden Harbor. The explosives-laden 
boat sinks shortly after launching. 


NASHERI and other individuals return to the beachfront and salvage the 
sunken boat and explosives. 


QUSO" and NIBRASS’” travel to Bangkok, Thailand. QUSO is directed to 
shave and wear western-style clothing so he doesn’t attract attention on trip. 
They deliver approximately $36,000 to KHALLAD in Bangkok, Thailand. 


NASHERI informs BADAWI of aborted attempt to bomb USS The Sullivans, 
and discusses ongoing plot to attack U.S. naval ship and comply with Usama 
Bin Laden edict to drive American forces from the Arabian Peninsula. 


HASAN"”' leases a lodging to act as a safehouse in Aden. 


‘65 U.S. District Court, Southern District of New York. Indictment $12 98 Cr. 1023 (KTD). United States of 


America, Plaintiff, vs. Jamal Ahmed Mohammed Ali Al-Badawi and Fahd Al-Quso, Defendants; available from 


http://news.findlaw.com/hdocs/docs/cole/usalbadawi051503ind.pdf; 


Internet; accessed 5 April 2004. 

166 Abdul Rahim Mohamed Hussein Abda Al-Nasheri, aka NASHERI. $12 98 Cr. 1023 
167 Jamal Ahemd Mohammed Ali Al-Badawi, aka BADAWI. S12 98 Cr. 1023 

‘68 Tafiq Muhammed Saleh Bin Roshayd Bin Attash, aka KHALLAD. $12 98 Cr. 1023 
‘°° Fahd Al-Quso, aka QUSO. S12 98 Cr. 1023 

° Tbrahim Al-Thawar, aka NIBRASS. S12 98 Cr. 1023 
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Summer 2000 HASAN leases an apartment to act as an observation post perched on the hills 
overlooking Aden harbor. 


Summer 2000 KHALLAD and NASHERI meet with Usama Bin Laden and other individuals 
in Afghanistan. NASHERI tests explosives while in Afghanistan. 


Summer-Fall 2000 NASHERI and other individuals refit the boat that had sunk in January 2000, 
and test the explosives that had sunk in the boat. 


September 2000 BADAWI trains QUSO to film the planned attack on a U.S. ship in Aden 
Harbor from an area apartment and vantage point. 


Sept - Oct 2000 BADAWI provides QUSO with a pager, and informs QUSO that he’ll receive 
a predetermined code that would indicate the imminent attack on a U.S. ship. 
QUSO would depart to the area apartment and vantage point. 


Sept — Oct 2000 KHALLAD returns from Yemen to Afghanistan. 


October 12, 2000 NIBRASS, HASAN, and other individuals tow the explosives-laden boat with 
a truck to the Aden Harbor beachfront. 


October 12, 2000 QUSO departs his residence to go to the vantage point. 


October 12, 2000 NIBRASS and HASAN board the explosives-laden boat and launch the boat- 
bomb in the direction of the USS Cole. 


October 12 11:18 a.m. NIBRASS and HASAN offer friendly gestures to observing crew members of 
the USS Cole, and steer the boat alongside USS Cole. Boat-bomb detonates 
next to USS Cole.'” 17 USS. sailors killed; 39 U.S. sailors wounded. The 
terrorists NIBRASS and HASAN killed in suicide attack. The blast leaves a 
40-foot diameter hole in ship’s side with the ship in jeopardy of sinking. 


The Attack 


As the USS Cole entered Aden harbor, the ship did not dock at the quayside. Refueling took 
place at a water-borne platform known as a dolphin. This fuel transfer point is a 
commercially run Yemeni operation and lies about 600 meters offshore. The U.S. Navy 
contracted for such refueling operations. 


After verifying the refueling alignment, refueling operations commenced at 10:31 a.m. At 
11:18, two suicide attackers detonated their explosives-laden boat against the side of the USS 
Cole.'”? The small boat was probably loaded with between 400 to 700 pounds of explosives, 
and the blast blew a 40-foot hole in the port side, amidships, of the USS Cole. U.S. analysis of 
explosive residues found at the blast site indicates that the terrorist bombers used C-4. 


171 Hassan Awadh Al-Khami, aka HASAN. S12 98 Cr. 1023 
172 Franks, 7. 
"3 Thid, 
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Supplemental Vignettes: The Immediate Aftermath 


Shortly after the boat suicide attack, three groups claimed responsibility for the Aden attack — 
the Islamic Army of Aden-Abyan previously unknown in Yemen, the Army of Mohammed, 
and the Islamic Deterrence Forces (IDF). The Army of Mohammed also claimed 
responsibility for bombing the British embassy in Sana’a the following day. The Islamic Army 
has previously claimed responsibility for several incidents in Yemen which turned out not to have 
been terrorist acts. The IDF’s statement said the attack was in “defence [defense] of the honour 
[honor] and dignity of the Islamic nation and to avenge the blood of the oppressed Muslim nation in 
Palestine with the blessing of the American regime for that enemy ... This operation will not be the 
last, as such attacks will continue against our enemy, and the enemy of our Arab and Muslim nation: 
America and its artificial Zionist entity in Palestine.”'” 


In stark contrast to terrorist announcements, many governments and allied military forces 
provided immediate responsive support during the aftermath of the USS Cole bombing. The 
Government of Yemen provided initial medical support and security forces to protect U.S. 
Government officials arriving in the area. France and Djibouti helped with initial medical 
evacuation and treatment. Royal Navy ships HMS Marlborough and HMS Cumberland 
provided damage control and other assistance. Expedited overflight clearances were 
approved, as well as the use of air bases from Saudi Arabia, Egypt, Bahrain, Oman, Kuwait, 
and Qatar. 


Intelligence Threat and Warning 


The threat situation was monitored regularly in Yemen and throughout the U.S. military area 
of responsibility (AOR). The U.S. intelligence community and USCENTCOM considered this 
area a High Threat environment. A number of threat assessments had been conducted in the 
port and throughout the area. However, leading up to the attack on USS Cole on October 12th, 
no specific threat information for Yemen or for the port of Aden was reported that would 
cause a change to the assessment.'”° 


The DOD USS Cole Commission Report (9 January 2001) states that intelligence priorities 
and resources have shifted from a Cold War focus to new and emerging threats only at the 
margins. Contemporary events indicate that intelligence resources need to be reprioritized for 
collection and analysis, including human intelligence and signal intelligence, against 
terrorism. Intelligence production must be refocused and tailored to safeguard transiting units 
in order to mitigate the terrorist threat. Furthermore, a requirement exists for an increase in 
counterintelligence (CI) resources dedicated to combating terrorism and development of 
clearer CI assessment standards. '”” 


The investigation by the DOD Commission identifies that the commanding officer of the USS 
Cole did not have the specific intelligence, focused training, appropriate equipment or on- 
scene security support to effectively prevent or deter such a determined, pre-planned assault 


174 « Attack on the USS Cole,” Yemen Gateway [database on-line]; available from http://www.al- 
bab.com/yeman/cole1.htm; Internet; accessed 6 April 2004. 

15 Pranks, 3. 

”° Thid., 6. 

’’DoD USS Cole Commission Report, 1. 
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on his ship.'”? In-transit units require intelligence support tailored to the terrorist threat in 


their immediate area of operations. This support must be dedicated from a higher echelon with 
focused analysis and tailored production.'”” Independent transiting units must be better trained 
and resourced to submit appropriate requests for information to force intelligence 
organizations. This will allow these intelligence activities to be responsive to the transiter’s 
anti-terrorism/force protection (AT/FP) requirements. 


Security Measures in Effect 


Military sources and several news agencies reviewed the actions conducted, as well as actions 
not conducted, by the ship and crew as the USS Cole entered the harbor. Clearly, the 
terrorists were able to observe patterns that previous ships displayed during their visits to 
Aden Harbor. For example, terrorists could easily see if U.S. forces attempted to control the 
movement of small boats near a warship in the harbor, as well as what crewmember presence 
and actions were visible on deck.'®° 


The USS Cole had a crew trained in force protection and was conducting a force protection 
plan for the particular circumstance of a refueling operation in Aden Harbor when the 
terrorists attacked. Not all Threat Condition measures were being implemented during the 
refueling task. While refueling was ongoing, a small boat appeared about 09:20 a.m. to 
remove garbage from the USS Cole. This boat and two men were turned away without 
conducting trash removal. However, a short time later, garbage removal was authorized and 
three garbage barges were expected. Two were tied up on the port side of the ship. Then, a 
small boat about 35 feet in length was observed coming quickly out from the city but slowed 
as it neared the USS Cole. The boat and two men showed no hostile intent, and were even 
waving to the crew and smiling. Some crew assumed this was a third garbage boat. This small 
boat continued to move toward the USS Cole from the 11 o’clock position relative to the 
ship’s bow, pulled alongside the port side, amidships, of the USS Cole. The two-man boat 
crew detonated the explosives as a suicide attack.'*! 


From post-attack analysis recommendations, U.S. military forces must create an integrated 
system of training that produces a unit that is clearly and visibly ready, alert and capable. 
To achieve this level of AT/FP proficiency, this type of training must be elevated to the 
same priority as primary mission training.'*’ DOD and Service guidance on the content of 
anti-terrorism/force protection Level II] commander-type training must be more definitive 
if senior field grade officer (O-5 and O-6) levels are to execute their AT/FP 
responsibilities."°’ Demonstrating visible force protection by transiting units can more 
effectively deter terrorist attacks.'®* In any case, all missions should include an 


”® Department of Defense News Release Archive, “DoD News: Navy Announces Results of Its Investigation on 
USS Cole;” available from http://www.defenselink.mil/releases/2001/b011192001 _bt031-01.html; Internet; 
accessed 11 February 2004. 

” DoD USS Cole Commission Report, 7. 

8° « Attack on the USS Cole,” Yemen Gateway [database on-line]; available from http://www.al- 
bab.com/yeman/cole1.htm, 

8! Case Study: USS Cole (DDG 67), U.S. Navy Center for Antiterrorism and Navy Security Forces, 
Antiterrorism Officer (ATO) Course, 2005. 1 and 9. 

8° DoD USS Cole Commission Report, 2 

*° Tbid., 9. 

* Tbid., 6. 
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antiterrorism mission statement. Using a defense in depth concept for force protection 
with assessments, warnings, and threat zones cam minimize vulnerabilities. Clearly 
understood friendly forces rules of engagement (ROE) and posted orders provide 
standards and guidance for conducting deliberate, and as required, instantaneous decisions 
and actions. Doctrine, with officers and crews trained and ready in tactics, techniques, and 
procedures, can enhance force protection postures. 


Host Nation Relationship 


While classifying the diplomatic clearance and logistics requirement process may improve the 
operational security of transiting units, it is not practical due to the commercial nature of the 
process. Local providers of goods, services, and transportation must be employed to support 
these type operations. Consequently, they must be evaluated in ways that enhance the AT/FP 
posture of the in-transit unit.'°’ According to Admiral Vern Clark, Chief of Naval Operations, 
refueling arrangements had been made 10 to 12 days earlier through the U.S. Embassy in 
Yemen - a standard procedure.'®° Implementing proactive AT/FP measures must mitigate the 
real and potential effect of public knowledge of visits by U.S. military forces. 


“As I have previously stated in testimony before this [Senate and House 
Armed Services] committee, ‘Our men, women, DOD civilians, and 
Diplomats in the region are under constant observation, and, in some 
cases, being stalked, everyday, 24-hours-a-day, because the terrorist 
threat in this region is very real.’”'®” 


General Tommy Franks 
Commander 
U.S. Central Command 


The U.S. criminal investigation into the attack was led by the U.S. FBI, which immediately 
deployed nearly 200 agents and technicians to begin the arduous work of putting together the 
pieces of the puzzle and finding who was responsible. The FBI worked closely with officials 
from the Naval Criminal Investigation Service, NYPD [New York Police Department] 
officers from the New York Joint Terrorism Task Force, and Yemeni investigators.’ 


Yemen, while recognizing that it had to cooperate to some extent for the sake of its relations 
with the U.S., insisted on maintaining its independence and sovereignty in a case which had 
occurred within its national territory. Investigative disputes between Yemen and the U.S. 
resulted in a phone call from President Bill Clinton to President Salih. On November 6, State 
Department spokesman Richard Boucher said: “We got good cooperation during the first 


'® Tbid., 8. 

186 « A ttack on the USS Cole,” Yemen Gateway [database on-line]; available from http://www.al- 
bab.com/yeman/cole1.htm, 

187 Franks, 7. 

188 Department of Justice, “Al Qaeda Associates Charged in Attack on USS Cole, Attempted Attack on Another 
U.S. Naval Vessel,” Public Relations Release #298: 05-15-03, 3; 15 May 2003; available on 
Http://www.usdoj.gov/opa/pr/2003/May/03_298.htm; Internet; accessed 16 February 2004. 
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phase. ... We're in discussions with them [the Yemenis] on the modalities of how we will 
cooperate further in the future...” 


Terrorist Tactics, Techniques, and Procedures 


Post-attack investigation revealed there may have been at least three previous terrorist attack 
attempts in Yemen. In the first attempt during November 1999, terrorists had planned to 
attack a convoy of U.S. military personnel heading to Yemen's National Center for the 
Removal of Land Mines. This was foiled when Yemeni security forces discovered explosives 
about a mile from the hotel where the Americans were staying. Suspects questioned in 
connection with the USS Cole bombing were said to have known details of the route taken by 
the Americans to and from the center. A second attempt allegedly targeted the Royal Hotel in 
Aden, where most of the 30 American servicemen were billeted. The third attempt was an 
intended attack on 3 January 2000 to bomb USS The Sullivans, a U.S. destroyer warship as it 
refueled in Aden.‘*° 


The U.S. Federal Indictment states that terrorists conducted their planning and preparations 
through many ruses and covert means. These included, but were not limited to, front [false] 
companies, false identity and travel documents, coded correspondence, and false information 
provided to authorities. ”” 


The terrorists organized in a cellular structure for command and control. After recruitment, 
cell members received deliberate phases of indoctrination and training. Leaders, cadre, and 
supporters of this cell were focused on a particular mission and target of attacking a U.S. ship. 
When an unexpected sinking of the terrorist bomb-boat occurred and precluded the January 
2000 attack, cell members regrouped and continued to prepare for a similar mission in Aden 
Harbor. The sequence of planning and preparation notes a very small cell that usually 
compartmented knowledge among two or three individuals, and insulated more senior 
terrorist leaders from the specific terrorist act against the USS Cole. 


Operational Lessons Learned 


As noted in the DOD USS Cole Commission Report, the links between national policies and 
resources, and individual transiting units are the geographic Unified CINCs or military 
commanders-in-chief [since retitled as Combatant Commander] and their [Service] 
Component Commanders. A significant lesson learned is to recognize that transiting units do 
not have time or resources to focus on a series of locations while in transit. This requires 
these units to rely on others to support their efforts to deter, disrupt and mitigate terrorist 
attacks. The Component Commander has the operational war-fighting mindset for the region 
and is capable of controlling the resources to fight the fight and tailor specific anti- 
terrorism/force protection measures to protect transiting units.'?! U.S. military forces must get 
out of the purely defensive mode by proactively applying AT/FP techniques and assets to 
detect and deter terrorists. Second, an additional lesson learned is acknowledging that transfer 


189 « Attack on the USS Cole,” Yemen Gateway [database on-line]; available from http://www.al- 
bab.com/yeman/cole1.htm. 

' Indictment $12 98 Cr. 1023, 6 and 7. 

‘8! DoD USS Cole Commission Report, 2 
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of transiting units between and within theaters must be better coordinated. Third, a discrete 
operation risk management model should be adopted and utilized in AT/FP planning and execution. 


Case Discussion Questions 
Intelligence and Threat Warning? 


What activities preceding the bombing attack might have indicated the tactical targeting of the 
USS Cole in an operational level U.S. intelligence estimate? 


Security Measures in Effect? 


How did U.S. force protection measures encourage the terrorists to select a U.S. Navy 
ship for attack? 


What does the proximity of distance of the “boat bomb” detonation to the USS Cole suggest 
in force protection vulnerabilities? 


Given the same bomb (IED) delivery means and scenario of the USS Cole, how could 
terrorists have increased mass casualty effects as even more devastating? 


Host Nation Relationship? 


How could the U.S. military unit chain of command and local Yemeni have cooperated more 
effectively in harbor security and post-attack investigations? 


What rationale existed for choosing Aden harbor as a refueling site in the region? 

Terrorist Tactics, Techniques, and Procedures? 

In what other instances has al Qaeda created a vulnerability by employing innovative tactics? 
Why did the terrorists use a small boat to attack the USS Cole in Aden harbor? 


How did the terrorist group structure itself, communicate, and operate during the phases of 
planning and execution of the USS Cole bombing attack? 


Assessment 


International media attention spotlighted the successful terrorist maritime attack on U.S. 
military forces in Yemen. U.S. military forces suffered loss of life and serious wounds, and 
about $250 million in damage to a warship. Terrorists achieved objectives of notoriety with 
a worldwide audience and significant psychological trauma of a global audience through 
U.S. military casualties, a visibly damaged U.S. warship, and a significant escalation of 
maritime terrorism. 


In January 2001, Usama bin Laden celebrated the bombing of USS Cole with a poem he 
recited at his son's wedding: 
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A destroyer: even the brave fear its might. 

It inspires horror in the harbour [harbor] and in the open sea. 
She sails into the waves 

Flanked by arrogance, haughtiness and false power. 

To her doom she moves quickly 

A dinghy awaits her, riding the waves. '”” 


U.S. military forces lost prestige when a berth for refueling considered relatively safe, was the 
site of a devastating attack by suicide terrorists. The Yemeni Government lost national 
prestige due to its inability to prevent such a terrorist attack in one of its principal harbors and 
seaports. The attack strained the credibility of selected Yemeni government officials with 
regional neighbors and commercial business associates. From an Islamic extremist 
perspective, the attack denounced Yemeni cooperation with U.S. military forces near the holy 
places of the Islamic faith. 


Despite a long investigation by U.S. and Yemeni authorities there is still no conclusive proof 
that bin Laden specifically ordered the attack on the USS Cole. However, Badawi, regarded 
as the most senior of the Cole suspects who have been arrested, told his investigators that he 
received telephone instructions for the bombing from Mohammed Omar al-Harazi in the 
United Arab Emirates. Badawi said he had originally met Harazi in Afghanistan during the 
war.’ Badawi indicated that Al-Harazi’s tone and manner led him to believe that Al-Harazi 
was receiving orders and financing for the attack on the USS Cole from bin Laden.’™* A 
senior Yemen government official stated that Al-Harazi was the organizer for a foiled plot to 
blow up the U.S. embassy in India.'”° 


Beas 


Figure 4-5. The USS Cole (DDG 67) Glides to Sea. 
(Source: U.S. Navy photo by Stacey Bynington.) 


® «Attack on the USS Cole,” Yemen Gateway [database on-line]; available from http://www.al- 
bab.com/yeman/cole1.htm. 

°° Ibid. 

4 «Yemen names 6 suspects in USS Cole bombing,” CNN.com, World - Middle East, 13 December 2000. 
[database on-line]; available at http:/Awww.cnn.com/2000/WORLD/meast/12/13/yemen.cole.ap/; Internet; 
accessed 26 April 2004. 

% «Attack on the USS Cole,” Yemen Gateway [database on-line]; available from http://www.al- 
bab.com/yeman/cole1.htm, 
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The initial damage repair estimate to the USS Cole (DDG 67), a modem Aegis missile 
equipped warship, was just under $250 million. In 2001 U.S. dollar value, this repair cost was 
equivalent to about one-fourth of the total construction and commissioning cost of the 
warship. ”° Following 14 months of repairs, the guided missile destroyer USS Cole (DDG 67) 
rejoined the U.S. Atlantic Fleet at sea in April 2002. 


“We have not forgotten this nation’s commitment to bring 
to justice all those who plot murder and orchestrate terror — 
no matter how long they run or how far they flee.” |” 


Honorable John Ashcroft 
Attommey General 
U.S. Department of Justice 


196 Perl and O’Rourke, 1. 

197 John Ashcroft, “Remarks of Attorney General John Ashcroft, Indictment for the Bombing of the U.S.S. Cole, 
“ [database on-line] (Washington, D.C., 15 May 2003); available from 
http://www.usdoj.gov/ag/speeches/2003/051503agremarksucccole.htm; Internet; accessed 19 February 2004. 
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Chapter 5: London Bombings of 7 July 2005 


The morning flurry of people traveling to work in central London started like many other 
summer days, but July 7, 2005 changed abruptly as the subway system stopped and 
conflicting reports signaled that something was horribly wrong. Rush-hour bomb attacks 
occurred almost simultaneously on three subway lines. Soon afterwards, a bomb detonated on 
a double-decker bus as it slowly traversed city traffic jammed by detours and temporary road 
blocks due to the evolving crises near several subway stations. 


{| London Bombings 7 July 200 | 
See SE PSs. 


~ 


} 


Figure 5-1. Above. London Rail Transportation Network Map 
(Source: http://www.geofftech.co.uk/tube/sillymaps/travel_times.jpg) 

Figure 5-2. Above, Left. Khan as a School Mentor 

(Source: http://www.timesonline.co.uk/article/0,22989-1693463,00.html) 
Figure 5-3. Above, Right. Khan in a Suicide Videotape 

(Source: www.epolitix.com/NR/rdonlyres/35FAE68F-9A33-4...) 


European nations and other regions of the world demonstrated a growing concer about 
domestic “home-grown” terrorism as facts emerged on the terrorists responsible for the 
London bombings. The terrorists conducting these attacks on the people of London were 
United Kingdom citizens. Terrorism, in the context of July 2005 London, spotlighted that 
such criminals may or may not be readily identified as a specific threat in a population. Now, 


5-1 


TRADOC G2 Handbook No. 1.01, Terror Operations: Case Studies in Terrorism 25 July 2007 


a clear and present enemy was living and operating with deadly effect among a general 
population in Western Europe. 


This case study presents an unclassified summary of terrorist motivations leading up to and 
including the London subway and bus attacks; planning and preparation; tactics and 
techniques of the multiple point-area bombings; and the immediate aftermath of the incident. 
Several vignettes highlight terrorist characteristics, London emergency response and 
treatment of victims, and governmental responses to the attack. 


A primary underlying aim of terrorism is a demoralizing psychological effect on the 
target population and its leaders, often with explicit media coverage of mass casualty or 
mass destruction effects, to erode resolve and enhance terrorist objectives. 


However, acts of terrorism can also have an opposite effect of fortifying the resolve of a 
population. The immediate public outrage in London, the United Kingdom, and many 
nations of the world appears to illustrate such resolve in the July 2005 London 
bombings. 


This was not a terrorist attack against the mighty and the powerful. It 
was not aimed at Presidents or Prime Ministers. It was aimed at 
ordinary, working-class Londoners, black and white, Muslim and 
Christian, Hindu and Jew, young and old. It was an indiscriminate 
attempt to slaughter, irrespective of any considerations for age, for class, 
for religion, or whatever. That isn’t an ideology, it isn’t even a perverted 
faith — it is just an indiscriminate attempt at mass murder and we know 
what the objective is. They seek to divide Londoners. They seek to turn 
Londoners against each other. ..Londoners will not be divided by this attack.'”° 


Honorable Ken Livingstone 
Mayor of London 
July 7, 2005 


Introduction 


The July 2005 bombings in London marked a different type of terrorist attack in Western 
Europe. The intended purpose caused mass casualties and significant disruption to a major 
metropolitan city and its people, but the more extraordinary aspect was the nationality of the 
terrorists. British citizens had conducted mass murder on their own countrymen. Comments 
from the general population paralleled those of a member of London University’s War Studies 
Institute: “I certainly think this is a new dimension...These are people who grew up in 
Britain, that are now attacking their own community, and taking other Muslim people into 
their missions and killing them...a novelty we haven’t seen in this country so far.”'”” 


'88 «Mfayor’s Statement 7 July 2005;” available from http://www.london.gov.uk/mayor/mayor_statement_070705.jsp; 
Internet; accessed 23 January 2006. 

199 Matthew Chance, “Britain’s home-grown terrorists,” CNN.com WORLD; available from 
http://www.cnn.com/2005/WORLD/eurpoe/07/14/homegrown.terror/; Internet; accessed 23 January 2006. 
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Leaming objectives are introductory and can be used for analysis and application of lessons 
learned on several levels of training, professional education, or operational perspective. 
Chronologies of events provide insight on events immediately before and after the 
bombings.*” The timelines of various reports display norms of confusing and conflicting 
information as news of an incident develops and facts are confirmed. Some data was 
irrefutable but meaningful only after the attacks. Train station and subway Closed Circuit 
Television (CCTV) cameras recorded sequences of activity among the suicide bombers on 
July 7, 2005. Review of individual bomber actions near or in the subway system does not 
indicate any overt bizarre behavior. In hindsight, a notable exception on a city street might be 
the bomber as he fidgeted with his bag on the top deck of a double-decker bus just prior to the 
bomb detonation. 


Criminal investigation and counterterrorism actions by UK government organizations 
centered their efforts quickly based on forensic evidence from the bomb sites. With hours of 
the attacks, one fact was certain: London experienced a multiple site, nearly simultaneous, 
mass casualty causing attack by suicide bombers along the subway lines of the London 
underground transportation network. And the terrorists were “home-grown.”*°! What links, if 
any, existed with foreign extremists and terrorism? 


Note: This case study does not address the terrorist bombings in London on July 22, 2005. In an 
apparent multiple site suicide pact, four individuals attempted to explode bombs in bags or 
rucksacks. Target locations were three subway trains and one bus in central London. Fortunately, 
small explosions at each target site did not detonate the larger bomb package.””* 


Learning Objectives 


Learning objectives focus on analyzing case study information in order to synthesize and 
evaluate insights from this attack, discern patterns of terrorist method and means, and 
determine likely trends in future terrorist activities. Comparing and contrasting conditions, 
circumstances, and asymmetric options available to the terrorist can enhance judgment to 
recognize vulnerabilities, identify threats, and minimize the ability of terrorism to impact on 
accomplishing the mission of a targeted activity or organization. 


°° Compare several chronologies to appreciate initial reports, conflicting information, and immediate response 
actions among a multi-site incident in a major metropolitan area. “Time of the 2005 London Bombings, 
Wikipedia, The Free Encyclopedia (2005); available from 

http://en.wikipedia.org/wiki/Timeline_of the 2005 London bombings; Internet; accessed 26 January 2006. 
See also, “London Terror: Minute-by-Minute Account,” CNN.com International; available from 
http://edition.cnn.com/2005/WORLD/Europe/07/07london.timeline/; internet; accessed 26 January 2006. See 
also, “Chronology of the Attack on London,” Spiegel Online, English Service; available from 
http://service.spiegel.de/cache/international/0,1518,364234,00.html; Internet; accessed 26 January 2006. 

201 Matthew Chance, “Britain’s home-grown terrorists,” CNN.com WORLD, 23 January 2006. 

°°? Paul Tumelty, “Reassessing the July 21 London Bombings,” Terrorism Monitor 3, no. 17 (8 September 
2005): 1-3. The Jamestown Foundation provides an overview of the 21 July 2005 bombings as well as inferences 
related to the 7 July 2005 suicide bombings. See http://Awww.jamestown.org. 
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The objectives for this case study are: 


e Describe intelligence indicators that might have been analyzed to create a more effective 
tactical estimate of terrorist intention and capability in the July 2005 attacks. 


e Understand the terrorist’s motivation of choosing the population of London and 
the London subway system as a terrorist target of high value. 


e Recognize aspects of force protection or security measures that could apply in 
domestic terrorist threats to U.S. forces or citizenry in the United States 
homeland and abroad. 


e Explain terrorist organizational structure and tactics, techniques, and procedures 
(TTP) used for the London subway system and transportation attacks. 


e Deduce possible trends for terrorist acts with the objective of an increased 
combination for mass casualties and mass destruction. 


Case Study — London Bombings of 7 July 2005 


At about 08:50 within seconds of each other on July 7, 2005, suicide terrorists detonated 
bombs on three subway trains as the trains departed into tunnels of the London subway 
system. A short time later at 09:47, an explosion ripped open a double-decker bus in the 
snarled traffic of a busy London street. Within moments of the nearly simultaneous subway 
train explosions, scores of people were dead and dying. Injured passengers groped for escape. 
Others trapped in subway cars, waited for help. Eventually some passengers started to extract 
themselves and each other from wreckage or stalled train cars and walked along subway 
tunnels to stations they had recently departed. Less than one hour later, a flash of light and 
explosion transformed a busy city street into a scene of death and injury around the peeled 
wreckage of a city bus. Emergency response efforts were immediate with triage at the train 
stations, as well as evacuation and treatment of injured citizens to nearby hospitals. Similar 
actions occurred as the shock of the bombed bus on a city street shifted to concern and care 
for the people in and around the bomb site. 


According to Prime Minister Tony Blair, “The timing of the Tube [subway] explosions was 


designed to be at the peak of the rush hour and thus to cause maximum death and injury.””°? 
However, more than death and destruction were at the root of this act of terrorism. 


Background 


For all the democratic freedoms guaranteed by law in the United Kingdom, London in 
particular is publicized also as a haven for dissidents, radicals, and the fermenting of 


°° Tony Blair, “Prime Minister’s Response to the London Bombing, Terrorists Can Kill But They Will Never 


Destroy Our Way of Life,” (Delivered to Parliament, London, England, 11 July 2005) [EBSCO Host, Research 
Databases]; available from 
Http://web17.epnet.com/citation.asp?tb=1&_ug=sid+7FDF469B%2DEB1D%2D461A%2D...; Internet; accessed 
25 January 2005. 
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terrorism. The term “Londonistan”*™ has even been used in the media on occasion to indicate 
this delicate yet abrasive condition with extremism. Democratic freedom in the UK is a 
regular topic of dialog, as are policies for asylum from rogue regimes, national intelligence 
collection capabilities, and measures for antiterrorism and counterterrorism as part of the 
Global War on Terrorism. The benefits and protections of democratic institutions can also 
feed the ability to promote extremism. 


Dramatic examples of extremism and hate can collide with issues of homeland security and 
democratic security of a nation at large. For instance, early days of a fledgling concept 
emanating from extremists in London would grow into the al-Qaeda organization. 
Connection to such groups can connect to terrorist incidents from the late 1990s to more 
recent attacks in the initial years of this century. Individuals with an incendiary message, 
protected with rights of freedom of speech in a democracy, can demonstrate a dramatic impact 
on extremism. For example, Abu Hamza al-Masri was granted UK asylum in the 1970s and 
gained British citizenship in the early 1980s. He volunteered to fight in Afghanistan in the 
1990s, followed by a return to the UK with an extreme view of people he believed were 
enemies of Islam. His views and pronouncements from a mosque or other public places in the 
UK directed mass violence against non-Muslims. One speech cited in a British documentary 
film has al-Masri urging his followers to get an infidel “...and crush his head in your arms, so 
you can wring his throat. Forget wasting a bullet, cut them in half!”?” 


Abu Hamza al-Masri was convicted recently in the UK. He was sentenced to seven years in 
prison on six charges of soliciting murder, 21 months on three counts of incitement to racial 
hatred, three years for possessing “threatening, abusive or insulting recordings,” and three and 
a half years for having a document useful to terrorists.*°° 


°4 «7 ondonistan” is considered generally a derogatory term for the British capital of London. See an extract 
from Wikipedia, Londonistan; available from http://www.answers.com/topic/londonistan; Internet; accessed 15 
March 2006. 

2 Steve Coll and Susan B. Glasser, “In London, Islamic Radicals Found a Haven; [Final Edition], Washington 
Post, (Washington, D.C.) A.01, 10 July 2005, [Proquest database]; available from 
http://proquest.umi.com/pdqweb?index=151&did=86508591&...; Internet; accessed 25 January 2006. 

208 Chris Marsden, “Britain: Why did it take so long to bring Abu Hamza to trial?” 16 February 2006; available 
from http://www.wsws.org/articles/2006/feb2006/hamz-f16.shtml; Internet; accessed 16 March 2006. See also, 
http://www.almanar.com.|b/story.aspx? Language=en&DSNO=644579; Internet; accessed 16 March 2006. 
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Figure 5-4. Below, Left. Map of United Kingdom 

(Source: http://www.|ib.utexas.edu/maps/cia05/united_kingdom.gif) 
Figure 5-5. Below, Right. Greater London Map 

(Source: http://streetfaults.tfl.gov.uk/images/map-london-boroughs.gif) 
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Figure 5-8. Four Bombings in Central London 
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Another example of extremism is cleric Omar Bakri Mohammed who stated in 2004, "We 
don't make a distinction between civilians and non-civilians, innocents and non-innocents. 
Only between Muslims and unbelievers. And the life of an unbeliever has no value. It has no 
sanctity." Also in 2004, he declared during an interview with the Portuguese magazine 
Publica that attacks were “...inevitable. Because several [attacks] are being prepared by 
several groups....” One "very well organized" group in London calling itself al-Qaeda Europe 
"has a great appeal for young Muslims." And he further stated, "I know that they are ready to 
launch a big operation."*°” Just after the July 7, 2005 suicide bombings, he declared, "What 
happened...confirmed that as long as the cause and the root problem is still there...we will see the 
same effect we saw on July 7."°° 


Knowing today’s enemy in the Global War on Terrorism is not as obvious as it may have 
been in earlier sensational periods of al-Qaeda attention. Clearly still a threat, the al-Qaeda 
organization has changed since its origin. Even though the “hunt”””? has killed or 
captured many of the original key al-Qaeda leaders and disrupted organizational 
apparatus, veteran terrorists and new recruits continue to communicate, train, plan, and 
prepare for future attacks.”'° 


Even before al-Qaeda, the United Kingdom was no stranger to terrorism. Combating domestic 
terrorism in prior decades realized the value of maintaining good relationships with local 
communities. People in the community were a critical information and intelligence source to 
identify and defeat terrorists. Selective monitoring of electronic communications provided 
significant awareness of plots too, and allowed government authorities to preempt or 
minimize terrorist actions.*"' Specific to the July 2005 London bombings, community trust in 
law enforcement activities was a major supporting issue in the criminal investigations. Even 
though concem on racial profiling and anti-Muslim hate crimes increased after the 
bombings,”’* Scotland Yard noted that the majority of ethnic and national Muslim groups in 
Britain showed support to help police find the London bombers and planners. Also, police 
officials accented the worth of using the “language of dialogue” with British religious 
and ethnic groups, especially Muslims, as a best policy for fighting domestic terrorism 
and foreign extremism. 


°°7 «1 ondon Tube Bus Attack (LTBA) v1.5, 28 July 2005, 14:50:22EST / 18:50:22 GMT,” IntelCenter, 
(Alexandria, VA, 2005) 30 of 40. See www.intelcenter.com 

208 «Qmar Bakri Muhammad, Quotes,” Wikipedia; available from 
http://en.wikipedia.org/wiki/Omar_Bakri_ Muhammad; Internet; accessed 10 March 2006. 

°° George W. Bush, “President Addresses American Legion, Discusses Global War on Terrorism,” 24 February 
2006; available from http://www.state.gov/r/pa/ei/wh/rem/62075.htm; Internet; accessed 10 March 2006, 7. 
President Bush said, “We will stay on the offensive. We will continue to hunt down the terrorists, wherever they 
hide.” 

210 Brian Michael Jenkins, “The Lessons of London,” RAND Corporation Commentary, 17 July 2005; available 
from http://www.rand.org/commentary/071705SDUT.html; Internet; accessed 23 January 2006. 

211 Evan Thomas and Stryker McGuire, “Terror at Rush Hour,” Newsweek, 18 July 2005, 24-36. 

*1° «British minister warns against racial profiling,” International Relations and Security Network; available 
from http://www.isn.ethz.ch/news/sw/details.cfm?ID=12330; Internet; accessed 8 August 2005. 

*13 Samir Nasif, “UK’s Top Muslim Police Officer Urges Muslims to Help Find London Bombers,” World News 
Connection [EBSCO Host, Research Databases], 1 August 2005; available from 
http://web17.epnet.com/citation.asp?tb=1&_ug=sid+7FDF469B%2DEB1D%2D461A%2D...; Internet; accessed 
25 January 2006. 
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Networks such as al-Qaeda state a recurring aim to drive a wedge between the United States 
and its allies.*'* This reaches far beyond the combatant zones of Iraq and Afghanistan; this 
wedge attempts to split US allies and coalition partners over a worldwide program of 
combating terrorism and the resolve for collective security. Momentum and continuum are 
operational expectations for such terrorism. To accent this type of mindset for a perpetual 
condition of terrorism, Brian Michael Jenkins states, “There will be more Londons.” 
Continued successful terrorist acts are key to “...demonstrate capability,...hope to the 
terrorists’ perceived constituents, inspire others to take up arms, reveal vulnerabilities, attract 
recruits and financial contributions... end humiliation, restore honor, awaken the 
community...”*'° The London attacks could be a “...likely model for future US attacks.”7"° 


The British Terrorists 


Biographical sketches of the four suicide bombers provide perspective on citizens who 
decided to conduct terrorism on their own nation. Several issues remain open as criminal 
investigations continue to search for definitive answers. Other aspects look to terrorist support 
networking and how these four men were groomed and convinced to commit suicide and 
homicide. As noted in the UK government report on the bombings, the backgrounds of the 
four men appear largely unexceptional. The social life of community mosques, youth clubs, 
gyms, and religious bookshops may have been the opportunity for Khan to identify candidates 
for indoctrination and further commitment to an act of terrorism.”"” 


Table 5-1. London 7 July 2005 Suicide Bombers 


Name Age Nationality Husband | Occupation Home 
Mohammad 30 | British Yes School Dewsbury 
Sidique Khan Pakistani descent | (Father) | Mentor Leeds 
Shehzad 22 | British No University | Colwyn Road 
Tanweer Pakistani descent Graduate Leeds 
Germaine 19 | British Yes Carpet- Aylesbury 
Lindsay Jamaican-born (Father) | Fitter 
Hasib 18 | British No Student Colenso Mount 
Hussain Pakistani descent Drop-Out Leeds 
(Source: Face recognition of four men at “The British Terrorists” available from http://images.google.com. with name search. See 
also, “Suicide bombers’ ‘ordinary’ lives,” bbb.co.uk; available from http:/ews.bbe.co.uk/Thi/uk/4678837.stm 


214 Michael Hirsh, Mark Hosenball, and Kevin Peraino with Sryker McGuire, Emily Flynn, William Underhill, 
Christopher Dickey, Gameela Ismail, Zahid Hussain, Ron Moreau, Sami Yousafzai, and Daniel Klaidman, “ It 
Can Anywhere,” Newsweek, 1 August 2005, 36-39. 

*!5 Brian Michael Jenkins, “The Lessons of London,” RAND Corporation Commentary, 17 July 2005. 

*16 Charlotte Sector, “Experts Say Suicide Mission in United States Is Inevitable,” 18 July 2005; available from 
http://abcnews.go.com/International/story?id=942343&page=1; Internet; accessed 24 January 2006. 

*!7 United Kingdom. House of Commons. Report of the Official Account of the Bombings in London on 7 July 
2005 (May 2006). London: Her Majesty Stationary Office. HMSO, 2006, 13 and 16. 
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Mohammad Sidique Khan appears to be the “dominant figure with 
‘operational command’ of the group.” Speculation notes he 
probably coordinated with contacts outside the UK such as visits to 
Pakistan and other networking efforts.*’® He worked as a teaching 
Mohammad assistant and respected mentor on special needs and learning skills 
at a primary school in Leeds until December 2004. “He was a nice 
bloke...” noted a father of one of the school’s young students.””” 
Khan was married; his wife was pregnant and they had an 18-month 
old daughter. Earlier, he operated a gym for local youth associated with a mosque, but is 
reported to have been expelled from one mosque due to his extreme views of Islam. In 2004, 
he established another youth program in his local community. Some reports called it a 
learning center or bookstore. Although the building was closed often, local reports state that 
men were seen regularly meeting at the building. Khan, Tanweer, and Hussain lived in nearby 
neighborhoods and all three knew each other.””” 


Sidique Khan 


Shehzad Tanweer seemed a normal young man at 22 years old. A 
sports science graduate from a Leeds university, he came from a 
successful family whose father owned a small local business. 
Tanweer was a handsome, lean person who may not have been a 
loner, but did not have many friends and was not interested in the 
Shehzad relaxing social scene. An acquaintance in the local area said, 
Tanzeer Shehzad was very religious. “He used to go to the mosque a lot...he 
was anice, quiet person.”*" 


Tanweer had traveled to Pakistan once in 2003.*** As a friend of Mohammad Sidique Khan, 


they traveled together to Karachi, Pakistan on November 19, 2004. A week later, they 
traveled by train from Karachi to Lahore. While in Pakistan, Tanweer studied at one of the 
many religious centers-schools. Tanweer and Khan departed Pakistan together on February 8, 
2005.°*° Upon his return to the UK, he had grown a beard and prayed five times a day. Family 
members noted his concern over UK policies in Kashmir, Iraq, and Afghanistan; they knew 
that he idolized Osama bin Laden.*~* 


218 Daul Tumelty, “An In-Depth Look at the London Bombers,” Terrorism Monitor, 3, no. 15 (28 July 2005); 
available from http://jamestown.org/terrroism/news/article.php?=2369753; Internet; accessed 8 August 2005. 

*!9 Tara Pepper and Mark Hosenball, “A Deadly Puzzle,” Newsweek, 25 July, 2005, 40-42. 

220 «Suicide bombers’ ‘ordinary’ lives,” bbc.co.uk, 18 July 2005; available from 
http://news.bbc.co.uk/1/hi/uk/4678837.stm; Internet; accessed 6 March 2006. See also, Russell Jenkins, Dominic 
Kennedy, David Lester and Carol Midgley, “The London Bombers,” TIMESONLINE, 15 July 2005; available 
from http://www.timesonline.co.uk/article/0,,22989-1693739,00.html; Internet; accessed 6 March 2006. See 
also, “An In-Depth Look at the London Bombers,” Terrorism Monitor. See also, “A Deadly Puzzle,” Newsweek. 
221 Russell Jenkins, Dominic Kennedy, David Lester and Carol Midgley, “The London Bombers,” 
TIMESONLINE, 15 July, 2005; available from http://www.timesonline.co.uk/article/0,,22989-1693739,00.html; 
Internet; accessed 6 March 2006. 

°°? Tara Pepper and Mark Hosenball, “A Deadly Puzzle,” Newsweek, 25 July 2005, 40-42. 

223 «9 London bombers visited Pakistan,” CNN.com, 20 July, 2005; available from 
http://www.cnn.com/2005/WORLD/europe/07/18/london.attacks; Internet; accessed 23 January 2006. 

224 Daul Tumelty, “An In-Depth Look at the London Bombers,” Terrorism Monitor, 28 July, 2005; available 
from http://jamestown.org/terrroism/news/article.php?=2369753; Internet; accessed 8 August 2005. 
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Germaine Lindsay was a 19 year old husband and father who had 
converted to Islam when he was 15 years old. Born in Jamaica, he 
came to the UK when he was five months old. Lindsay lived his 
early years near Leeds in the small town of Huddersfield in West 
Germaine Yorkshire. School friends say he changed dramatically after his 
Lindsay conversion. He studied Urdu, wanted to be known as Abdullah 
Shaheed Jamal, and displayed devout manners and actions. 


He moved his family to Aylesbury in 2003. Lindsay may have met the other three terrorists 
while attending one of the clubs that Mohammad Sidique Khan established. Lindsay worked 
as a carpet fitter. A close friend stated that he traveled to a mosque in London; another local 
citizen reported that Lindsay traveled because the local mosques were too moderate for him. 
At the time of his suicide, he had a 15-month old child and his wife was pregnant.*” His wife 
said, “He was a loving husband and father.”””° 


Hasib Hussain, at 18 years old, was the youngest of the four suicide 

bombers. He experienced trouble at school and was withdrawn 

from some academic programs by school officials. Hussain went on 

a pilgrimage to Mecca with his father, and afterwards, is reported to 

Hasib have studied in Pakistan. Returning to Leeds, he grew a beard and 

Hussain wore traditional Muslim clothes.’ He liked sports but was 

unemployed. Often, he traveled to Dewsbury to worship. 

(Mohammad Sidique Khan had a home in Dewsbury.) On July 7, 

2005, Hussain told relatives that he was going to London to attend a religious lecture. Hussain 
had shaved his beard prior to the suicide attack.*”” 


Planning and Preparation 


What caused four British citizens to bond into a suicide pact with a religious-extremist bent? 
Some reports catalog a growing issue of “...a disaffected younger generation drifting into 
radicalism under the blind eyes of immigrant parents, slowly giving up more of its energy to 
groups whose zeal and camaraderie offer it a sense of purpose.’ A person or persons 
committed to recruiting terrorists often survey common meeting places such as mosques, 
clubs, or universities, and identity possible candidates for grooming. 


In this case, a common place for the four bombers was a gym associated with a mosque and a 
building described as a bookstore or learning center. Khan coordinated these meetings with 
the younger men. Gradually, a tighter hold developed on these individuals through 
propaganda, extremist viewpoints and preaching, and other bonding techniques as a select 


°° “Germaine Lindsay, Biography,” Wikipedia; available from http://en.wikipedia.org/wiki/Janal_Lindsay; 
Internet; accessed 7 March 2006. See also, Paul Tumelty, “An In-Depth Look at the London Bombers,” 
Terrorism Monitor, 28 July 2005. 

226 «Suicide bombers’ ‘ordinary’ lives,” bbc.co.uk; available from http://news.bbc.co.uk/1/hi/uk/4678837.stm; 
Internet; accessed 6 March 2006. 

*27 J F.O. McAllister, “Unraveling the Plot,” Time, 25 July 2005, 46. 

*°8 Paul Tumelty “An In-Depth Look at the London Bombers,” Terrorism Monitor, 28 July 2005, 2. 

29 J. F.O. McAllister, “Unraveling the Plot,” Time, 25 July 2005, 45. 


5-11 


TRADOC G2 Handbook No. 1.01, Terror Operations: Case Studies in Terrorism 25 July 2007 


group. In one example, a normally enjoyable sport gained some notoriety when photographs 
proved that a waving Khan and smiling Tanweer had been together white-water rafting in 
North Wales in June 2005.**° Similarly, Mohammad Sidique Khan may have met Germaine 
Lindsay through paintballing sessions with a group of young Muslim men.”*' Other forms that 
can weld affiliation include visits to locations for indoctrinating fundamental perspectives on 
religion, or training specific skills to conduct terrorist acts. 


How did the terrorists make their bombs? A residence in Leeds was identified as the bomb 
factory in the criminal investigation following the bomb attacks. A terrorism expert noted that 
the residence “...was a clearly and carefully thought out and effective manufacturing 
facility....”°°* Making this type of explosive is dangerous, yet, as noted in understatement by 
a senior US police official, “The recipe to make a bomb is unfortunately as available on the 
Internet as a recipe for meatloaf.”’*? Other details included the use of commercial grade 
refrigerators at the Leeds residence to keep the explosive materials cool; beverage coolers were 
used to transport the explosives in two cars. **“ 


The explosive used in each suicide attack was TATP. Each of the bombs used about two to 
five kilograms, or 10 to 12 pounds, of explosive.* Formal names are acetone peroxide or 
triacetone triperoxide, using the acronymn TATP.**° The suicide bombers used material 
available easily at neighborhood stores; the basic ingredients are drain cleaner, bleach, and 
acetone. Significant risk exists in making and moving this concoction. TATP is very unstable 
and sensitive to heat or friction.*°’ Another open briefing to business leaders reported that 
HMDT, or hexamethylene triperoxide diamine may have been used; this is made from 
chemicals similar to TATP. 


Choosing target sites and conducting tactical surveillance is an operational norm for such a 
well planned attack. After the bombing attacks, review of security camera footage indicated 
an apparent reconnaissance mission in late June 2005.7*° Three of the four bombers traveled 
for several hours on the subway system.” 


°2° Christopher Dickey, “Outward Bound?” MSNBC Newsweek World News, 28 July 2005; available from 
http://ww.msnbc.msn.com/id/8742370/site/newsweek/; Internet; 8 March 2006. 

*3! Paul Tumelty, “New Developments Following the London Bombings,” Terrorism Monitor 3, no. 23 (2 
December 2005); available from http://www.jamestown.org/terrroism/news/article,ph?artcileid=2369843; 
Internet; accessed 9 March 2006. 

°°2 Michael Holden, “London bombers staged dry run in the city,” Terror in London, 20 September 2005; 
available from http://www. int.iol.co.za/index.php?set_id=1&click_id...; Internet; accessed 8 March 2006. 

°°3 Djallal Malti, “One month on: But who planned the bombing?” Terror in London, 7 August 2005; available 
from http://www. int.iol.co.za/index.php?set_id1&click_id...; Internet; accessed 23 January 2006. 

234 «NYPD Officials Reveal Details of London Bombing,” wnbc.com, 3 August 2005; available from 
http://www.nbc.com/news/4806577/detail.html; Internet; accessed 8 August 2005. 

*%> United Kingdom. House of Commons. Report of the Official Account of the Bombings in London on 7" July 
2005 (May 2006). London: Her Majesty Stationary Office, HMSO, 2006, 4. 

°° « Acetone peroxide,” Wikipedia; available from http://en.wikipedia.org/wiki/TATP; Internet; accessed 6 
March 2006. 

237 «TATP is suicide bombers’ weapon of choice,” TIMESONLIN; available from 
http://www.timesonline.co.uk/article/o,,22989-1695442,00.html; Internet; accessed 6 March 2006. 

*°8 «British Police Sources Say Terrorists carried Out Rehearsal of London Bombing,” World News Connection 
[EBSCO Host, Research Databases], 20 September 2005; available from 
http://web17.epnet.com/citation.asp?tb=1&_ugsid+7FDF469B%2DEB1D%2D461A%2D...; Internet; accessed 
25 January 2005. 

°39 Michael Holden, “London bombers staged dry run in the city,” Terror in London, 20 September 2005. 
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Were the suicide bombers 
radicalized by a foreign handler? 
Although posed as one of several 
considerations in criminal 
investigations, no conclusive 
unclassified information is 
available to support the claim of 
a specific foreign handler. Yet, 
after the bombings, London’s 
Metropolitan Police _ stated, 
“There is still quite clearly a 
possibility, almost a certainty...” that 
others were involved in the 
organizational effort for the four suicide attacks.“” Several people were questioned for 
possible links to the suicide bombers; criminal investigations continue.**! One report alleges 
that Khan may have met with extremist Islamist group members in Malaysia or the 
Philippines as early as 2001.7” 


Figure 5-13. Possible Reconnaissance 28 June 2005 
(Source: media.washingtonpost.com/.../ PH2005092001610.jpg) 


240 


Notwithstanding, three of the four London bombers visited Pakistan in the year or two before 
the London bombings. Khan and Tanweer spent three months in Pakistan. Plane flights and 
airport security photographs confirm they flew into Karachi in November 2004 and also 
departed together in February 2005. Hussain flew to Pakistan in July 2004 and remained for a 
period of time before returning to the UK.” 


Whether domestic or foreign in scope, support activities existed for these four men to think, 
decide, and act without being compromised. Some of bombers were listed on law enforcement 
watch lists, but based on available information of their activities, they were deemed not 
significant for detailed surveillance. Investigative reporting indicated that the attacks may 
have been supported by al-Qaeda elements in Pakistan. One report states that numerous phone 
calls were made in May and June 2005 from public telephones in Pakistan to mobile 
telephones recovered at a location in Leeds where the rucksack bombs were made.*“* Within 
hours of the bombings, the British Foreign Secretary noted that the attacks had the 
«hallmarks of an al-Qaeda related attack.”?”” 


*“ Djallal Malti, “One month on: But who planned the bombing?” Terror in London, 7August 2005. 

*41 «7 July 2005 London bombings, Investigation, possible accomplices,” Wikipedia; available from 
http://en.wikipedia.org/wiki/2005 Londontransport explosions; Internet; accessed 23 January 2006. See also, 
http://www.foxnews.com/printer_friendly_story/0,3566,184217.00.html; Internet; accessed 8 March 2006. See 
also, http://www.cnn.com/2004/LAW/08/11/ny.terror.suspect/; Internet; accessed 9 March 2006. See also, 
http://abcnews.go.com/WNT/LondonBlasts/story?id=943648&page=1; Internet; accessed 6 March 2006. 

242 «1 ondon bomber was filmed in 2004,” Terror in London, 25 October 2005; available from 

http://www. int.iol.co.za/index.php?set_id=1&click_id...; Internet; accessed 23 January 2006. 

243 « ATTACKS ON LONDON,” CTV.cq; available from 
http://www.ctv.ca/generic/WebSpecials/london_attacks/; Internet; accessed 26 January 2006. 

*44 «115 still baffled in bomb plot hunt,” The Australian.news.com; 30 January 2006; available from 
http://www.theaustralian.news.com.au/common/story_page/0,5744,17977578%255E2703...; Internet; accessed 
31 January 2006. 

245 Steve Coll and Susan B. Glasser, “Attacks Bear Earmarks of Evolving Al Qaeda,” washingtonpost.com, AO1, 
8 July 2005; available from http://www. washingtonpost.com/wp- 
dyn/content/article/2005/07/07/AR2005070702389.html?refer...; Internet; accessed 8 July 2005. 
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What was the fiscal cost of the bomb making? Cost factor of the multiple point attacks was 
inexpensive and simple; one estimate is a cost of less than $5000.7° An official UK 
government estimate is an overall cost of no more than $14,000.” 


Other issues remain in question. Why did the suicide bombers retain identification cards and 
other personal papers on their person? This type of information and other forensic data 
collected at the bomb scenes were instrumental in tracing the identity of the four individuals. 
Why did the residence used to manufacture the explosives appear to provide materials and 
facilities for future use? Why were explosive devices found near Luton station in one of the 
rental cars used by the suicide pact?* 


The Attacks 


Early on the moming of July 7, 2005, three of 
the terrorists (Hasib Hussain, Shehzad Tanweer, 
and Mohammad Sidique Khan) traveled together 
in a rental car from West Yorkshire to Luton 
station about 45 kilometers north of London. 
The terrorists paid for a seven day parking 
permit and also purchased round trip tickets to 
London.” A fourth suicide bomber, Germaine 
Lindsay from Aylesbury, Buckinghamshire, met 


them at the Luton station.*”’ Lindsay used a rental 
251 


: 
y 
A 


aa? 
- 


car also.” On Luton station surveillance tapes Figure 5-14. Bombers Enter Station 
viewed after the bombings, a fifth man near the four 7 July 2005 

bombers was confirmed as a regular commuter and (Source: http://www.cnn.com/2005WORLDI/ 
eliminated from investigation to the bombings.” europe/07/18/london.attacks/) 


At about 07:20, the four men entered the train 

station and boarded the train to King’s Cross station. Each of the men carried a rucksack that 
contained an explosive device. The closed circuit television cameras of the King’s Cross 
station show the four men about 08:20. Upon arrival at the King’s Cross station as a group, 


246s ebastian Rosella, “Who Guided London’s Attackers?” latimes.com; available from 
http://www.latimes.com/news/nationworld/world/la-fg-britbombs6mar06,1,79705.story?coll...; Internet; 
accessed 6 March 2006. 

*47 United Kingdom. House of Commons. Report of the Official Account of the Bombings in London on 7" July 
2005 (May 2006). London: Her Majesty Stationary Office, HMSO, 2006, 23. 

*48 «7 July 2005 London bombings, Investigation, Suicide bombings,” Wikipedia; available from 
http://en.wikipedia.org/wiki/2005 London transport explosions; Internet; accessed 23 January 2006. 

*49 David Rising “Did London bombers know they would die?” Associated Press [News register Web archive]; 
available from http://www.w3ar.com/a.php?k=2224; Internet; accessed 6 March 2006. 

250 «fT ondon Tube Bus Attack (LTBA) v1.5 23 July 2005, 14:50:22 EST/18:50:22 GMT,” IntelCenter, (Alexandria, 
VA), 40 of 40; available from http://www. intelcenter.com; Internet; accessed 28 July 2005. 

251 J B.0. McAllister, “Hate Around the Corner,” TIME Europe Magazine; 17 July 2005; available from 
http://www.time.com/time/europe/magazine/article/0,13005,901050725-1083866-1,00.html; Internet; accessed 6 
March 2006. 

*°2 United Kingdom. House of Commons. Report of the Official Account of the Bombings in London on 7" July 
2005 (May 2006). London: Her Majesty Stationary Office. HMSO, 2006, 10. 
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the men dispersed as individuals and walked to their selected target subway trains.”> Khan 
took a train headed west; Tanweer took a train headed east; Lindsay took a train headed south. At 
08:50, three explosions within seconds of each other, on three separate subway trains, shattered 
the London morning. The bombs were detonated by cell phones set to alarm at 08:50.7°* Later 
investigation of the bomb sites, as well as the bomb factory in Leeds, provided no evidence of 
remote detonation or intention to construct remote detonators.””” 


Hussain’s movements were different. Speculation suggests that he was going to take a train 
headed north, but this action did not occur. He was the bomber on Bus No. 30. Reports that 
Hussain could not board an intended subway because northbound subway services were 
suspended was contested by a London transportation spokesperson. All six subway lines 
running through King’s Cross were operating at 08:50.°°° CCTV video shows Hussain going 
into shops and bumping into people as he walked in the area and into a pharmacy. He even 
went a fast-food restaurant.’ After failing to contact the other suicide bombers on their 
cellular phones [by this time, the other three bombers were dead], Hussain boarded a bus — 
Bus No. 30. 


As the explosion causes were still being 
determined, Bus No. 30 was operating 
along its route of Marble Arch at 09:00 
and arrived at Gloucester Place by 09:05. 
Subsequent bus stops on Marylebone 
Road at 09:10 were uneventful and by 
09:30 the bus approached Euston Road 
and Gower Street. The King’s Cross 
station was closed by this time due to the 
bombing and caused rerouting of traffic 
by police. The bus driver said, “My bus 
4 had been diverted because there were 
Figure 5-15. Bus Wreckage in Tavistock Square thousands of people coming out of the 
(Source: William Alfano, London Public Transportation Explosions, tube [subway]. There were many people 


7 July 2005, Western Europe Regional Coordinator, Overseas ; 
Security Advisory Council, n.d.) who were trying to get on the bus at 


*83 «T ondon Tube Bus Attack (LTBA) v1.5 23 July 2005, 14:50:22 EST/18:50:22 GMT,” Intelcenter, 4 of 40. 

254 «N'Y PD Officials Reveal Details of London Bombing,” wnbc.com, 3 August 2005; available from 
http://www.nbc.com/news/4806577/detail.html; Internet; accessed 8 August 2005. 

°° United Kingdom. House of Commons. Report of the Official Account of the Bombings in London on 7" July 
2005 (May 2006). London: Her Majesty Stationary Office, HMSO, 2006, 12. 


258 Deborah Haynes, “Hussain ‘snacked before attack on London bus’,” Terror in London, 25 August 2005; 


available from http://www.iol.co.za/index.php?set_id=1&click_id...; Internet; accessed 8 February 2006. 

*°7 Steve Watson, “Latest footage of London Bomber: More evidence of a frame up,” Prisonplanet.com, 1 
November 2005; available from 

http://www. prisonplanet.com/articles/november2005/0111051london_bomber.htm; Internet; accessed 6 March 
2006. 

258 Sebastian Rotella, “Who Guided London’s Attackers?” latimes.com, 6 March 2006; available from 
http://www. latimes.com/news/nationworld/world/la-fg-britbombs6mar06,1,79705.story?coll...; Internet; 
accessed 6 March 2006. 
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once...”””? Not familiar with the detour in traffic flow but attempting to deliver his passengers 


near their intended destinations, the bus driver navigated his way into Woburn Place and 
Tavistock Square.’ One bus passenger remembered another passenger near the rear of the 
bus. “This chap started digging down into his bag and getting back up...he did it about a 
dozen times in two or three minutes and looked extremely agitated.””°" 


Meanwhile, the bus driver was attempting to orient himself and had just called out to a police 
officer, asking where he was. The officer replied, “Tavistock Square, mate.” Just then, the bus 
exploded. The time was 09:47. 


People in the immediate vicinity of Bus No. 30 bus saw the explosion and felt a blast wave; 
some were injured by parts of metal and glass shards; some were dumbfounded for moments. 
A peaceful yet busy London square had transformed suddenly to a site of death and injury.” 
As one man raced out of his apartment after hearing a “tremendous thud,” he recalled a scene 
that was “oddly quiet” yet had people crying in each other’s arms.” 7° 


Other people at locations near the subway bombings experienced similar disbelief, combined 
with anxiety. What was happening? A businessman was startled by a sound “like a great door 
slamming” as windows shook and the building seemed to shudder. He looked out his fifth- 
floor office building window and saw smoke pouring from air shafts of the Aldgate East 
subway station.” 


The Victims and Emergency Response 


The four suicide bombings resulted in 56 deaths. Four of the deaths were the suicide 
bombers. Over 700 people were injured in the blasts. About 350 people required hospital 
treatment with over twenty people deemed serious or critical injuries. 


Emergency response activities in London had planned and rehearsed for mass casualty 
incidents. As multiple reports clarified the extent of emergency, citizens and professionals 
rallied at the bomb scenes and medical organizations activated triage and supplemental 
treatment measures on site or in nearby hospitals. At the underground bomb sites, some 
people were easier to reach than other victims based on the closeness to subway stations and 
wreckage from the explosions. The Russell Square explosion was particularly difficult 


259 «Buys driver recounts bomb horror,” CNN.com, 9 July 2005; available from 
http://www.cnn.com/2005/WORLD/europe/07/09/London.busdriver/index.html; Internet; accessed 23 January 
2006. 

6 «T ondon Tube Bus Attack (LTBA) v1.5 23 July 2005, 14:50:22 EST/18:50:22 GMT,” IntelCenter, 19 of 40. 

?61 Don Van Natta Jr. and David Johnston, “London Bombs Seen as Crude; Death Toll Rises to 49,” Program for 
International and Homeland Security, 9 July 2005, 15 of 43; available from 
http://homelandsecurtity.osu.edu/focusareas/transportation.html; Interet; accessed 12 August 2005. 

262 Evan Thomas, Stryker McGuire, Rod Nordland, Mary Acoymo, Ginanne Brownell, Emily Flynn, Rana 
Foroohar, Tara Pepper, William Underhill, Christopher Dickey, Eric Pape, John Barry, Trent T. Gegax, Mark 
Hosenball, Susannah Meadows, and Richard Wolfe, “Terror at Rush Hour, On the Trail: A massive worldwide 
hunt begins to catch the London killers,” [EBSCO Host, Research Databases]; available from 
http://web17.epnet.com/citation.asp?tb=1&_ug=sid+7FDF469B%2DEB1D%2D461A%2D...; Internet; accessed 
25 January 2006. 

*63 Michael Elliott, “Rush Hour Terror,” Time, 18 July 2005, 30. 

264 Evan Thomas, Stryker McGuire..., “Terror at Rush Hour, On the Trail: A massive worldwide hunt begins to 
catch the London killers.” 
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Table 5-2. London Bombing Fatalities 7 July 2005 


Location Mode Citizens Bomber Total | TOTAL 
Liverpool Street/Aldgate East | Subway 6 il Z 56 
King’s Cross/Russell Square Subway 25 1 26 Deaths 
Edgware Road Subway 6 1 Zz 
Tavistock Square Bus 14 1 15 >700 
Location Unannounced - i; - i Injured 


(Source: “Casualties of the 7 July 2005 London bombings,” Wikipedia; available from 
http:/Awww.answers.com/main/nyquery?method=4&dsis=2222&dekey=Casualties...; Intemet; accessed 7 March 2006) 


because it was about 500 yards from the nearest exit. As a single 12-foot wide tunnel about 60 
feet below the ground surface, blast had more effects on death, injury, and structural damage 
than in the other two tunnel blasts. Notwithstanding, the Aldgate and Edgware Road subway 
blasts had their own crises with death, dying, and passengers attempting to escape the 
wreckage and confusion of the explosion.” |The Aldgate subway explosion occurred about 
100 yards from the station; the Edgware Road explosion happened seconds after departing the 
Edgware station. 


Treatment of injuries included 350 people at 
the bomb scenes with over 200 people 
transported to Royal London Hospital. 100 of 
these injured people were kept overnight for 
care. Of 22 people in critical condition, one 
person subsequently died.**° As an example 
of response effort, the Walk-In Centre 
[clinic] on the grounds of London Hospital 
was alerted about 09:20 of a major incident. 
In a matter of minutes, clinic areas were 
prepared to receive emergency patients. 
About 10:00, a double-decker bus was the at London Bombings 

first arrival with injured citizens. Triage (Source: http:/images.com...www.bbe. 
quickly sorted patients in a stream of co.uk/...emergency_services_203x152.jpg ) 
casualties lasting over two hours.*°” Other 
hospitals near the bombing sites received 


Figure 5-16. First Responders 


265 Evan Thomas and Stryker McGuire, “Terror at Rush Hour,” Newsweek, 18 July 2005, 24-36. 

6 «Casualties of the 7 July 2005 London bombings,” Answers.com, Wikipedia; available from 
http://www.answers.com/main/ntquery?method=4&dsid=2222&dekey=Casualtiestof+the+...; Internet; accessed 
7 March 2006. 

*°7 Sonia Hall, “A walk-in centre’s experience of the London bombings,” Primary Health Care 15, no. 7 
(September 2005): 16. 
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casualties, triaged, and stabilized patients too. Serious injuries included body penetrations and 
blunt wounds, traumatic amputations, perforated eardrums, burns, and smoke inhalation.*°° 


Numerous examples of individual courage witnessed subway employees, citizens, 
paramedics, and other first responders going into the tunnels to assist in extracting injured 
passengers. Concern for possible secondary explosions made some response efforts 
problematic. Many individuals were treated at the subway stations, ticket halls, or nearby 
waiting areas. Injured people treated as “walking wounded” were evacuated on London buses 
to local hospitals for further treatment. Ambulance carriers and air ambulances were used for 
rapid transportation. Nearby specialist hospitals attended to casualties at the scene.” 


Individual acts indicated the keen sense of response and care by Londoners. One doctor 
working at his office at Tavistock Square heard a tremendous explosion, as racing emergency 
vehicles and television images indicated a crisis already in progress. He recalled, “We can see 
white smoke and debris raining down in the square...I am in shirtsleeves and a pinstripe suit, 
with no pen and no paper, and I am technically an uninjured victim.” He and his colleagues 
conducted ad hoc triage in an office building and operated in effect, a casualty clearing 
station. They provided emergency care and moved injured people to hospitals in a 
clinical priority.””° 


For emergency services in a terrorist incident such as the London bombings, a nearly 
simultaneous, multiple-point bombings accents several complications. Any multiple attack 
scenario will stress emergency response and recovery efforts. Communications between on- 
site and medical facilities may overload normal messaging means such as commercial 
telephone systems or mobile subscriber systems. Surface transportation routes and detours 
will congest and slow arrival at and departure from the incident sites.*”' Detailed planning 
and regular comprehensive rehearsals can offset these factors in a crisis situation for 
emergency services. 


Beyond the issue of physical injury repair and recovery, a professor of psychiatry at Kings 
College in London noted that treating psychological effects may be just as significant. “We 
must be careful to avoid shifting from the language of courage, resilience, and well-earned pride 
into the language of trauma and victimhood...The bombs made more than enough victims; it is 
important that we do not inadvertently create more.”*”* 


°68 Jim Ryan and Hugh Montgomery, “Terrorism and the Medical Response,” Perspective, (August 2005), 543- 


545; available from http://www.google.com/search?q=london+bombing+emergency+response+2005...; Internet; 
accessed 26 January 2006. 

*® Thid., 543-545. 

*7° Ed Edelson, “London Terror Bombings: doctors Tell Their Stories,” Healthfinder, Heal Day News, 10 August 
2005; available from http://www.healthfinder.gov/news/newsstory.asp?docID=527313; Internet; accessed 26 
January 2006. 

*71 Jim Ryan and Hugh Montgomery, “Terrorism and the Medical Response,” Perspective, 543-545. 

°” Ed Edelson, “London Terror Bombings: doctors Tell Their Stories,” Healthfinder, Heal Day News. 
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Aftermath of Suspicion and the Khan Video 


Immediately following the suicide attacks of July 7, 2005, many theories posed how and why 
the bombers conducted their attacks. Some reports proposed a deliberate plan and intention of 
suicide and homicide. Other reports suggested that the four men may have been duped as 
unknowing suicide bombers. Forensic evidence quickly established the identity of the four 
men who died at the attack sites. Hypotheses continued as journalistic reporting and police 
announcements fed bits and pieces of information to the general public in the weeks following 
the attacks. Then, in September 2005, al-Jazeera aired a videotape attributed to al-Qaeda with 
the suicide statement of Mohammad Sidique Khan. Earlier in August 2005 and although no 
direct claim for the bombings was announced by al-Qaeda, al-Zawahiri threatened the UK 
with “...more destruction after the explosions of London.”?”” 

“I’m going to talk to you in a language that you understand.”*”* The impact of Khan’s 
image and voice was startling — this man, in clothing and a video backdrop too familiar from 
many other al-Qaeda type videotapes, was very different. He spoke with a common English 
tone and rhythm; his words were not stilted with a “schooled English” or a foreign accent. He was 
home-grown! Mohammad Sidique Khan was a home-grown terrorist. 


Al-Qaeda’s al-Zawahiri made an accompanying statement to the Khan videotape. Khan used 
phrases of blame such as “... You democratically elected governments continuously perpetrate 
atrocities against my people...” al-Zawahiri stated a connection with comments about, 
“~..The lands and interest of the countries that took part in the aggression against Palestine, 
Iraq, and Afghanistan are targets for us.”*”” 


Claims that Khan had affiliated and received some form of training for his terrorists seemed to 
be true. His trips to Pakistan in 2004-2005 appear a logical channel.*’° Other questions 
remain. Were Khan and his suicide partners guided directly by some foreign handler or were 
the suicide bombers an autonomous cell? How was Khan recruited and developed to become 
a suicide bomber and cell leader of a multiple site suicide attack? A terrorism expert at the 
University of St Andrews in Scotland stated the point bluntly to the public. “Somebody 
obviously must have recruited Khan in the first place...He didn’t pop up just by accident.”””” 


On July 6, 2006, a videotape release of Shehzad Tanweer showed him dressed similar to Khan 
in the earlier Khan videotape and had the same website logo. Shehzad Tanweer says, “What 
you have witnessed now is only the beginning of a string of attacks that will continue and 


*73 Djallal Malti, “One month on: But who planned the bombing?” Terror in London, 7August 2005. 

°74 «Tape of Mohammad Sidique Khan,” Wikipedia; available from http://en.wikisource.org/wiki/Tape_of 
Mohammad_Sidique_Khan; Internet; accessed 6 March 2006. 

*75 Paul Reynolds, “Bomber video ‘points to al-Qaeda’,” bbc.co.uk, 2 September 2005; available from 
http://news.bbe.co.uk/1/hi/uk/4208250.stm; Internet; accessed 23 January 2006. 

276 Sebastian Rotella, “Who Guided London’s Attackers?” latimes.com, 6 March 2006; available from 
http://www. latimes.com/news/nationworld/world/la-fg-britbombs6mar06,1,79705.story?coll...; Internet; 
accessed 6 March 2006. 

id Brigitte Dusseau, “Six Months On, Unanswered Questions Haunt London Bombings, British Terrorism 
Expert: ‘Fundamental Questions’ Remain About London Bombings,” World News Connection, 5 January 2006 
[EBSCO Host, Research databases]; available from 
http://web19.epnet.com/citation.asp?tb=1&_ug=sid+B87A0B6A%2D490F%2D47D3%2D...; Internet; accessed 
24 January 2006. 
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become stronger.”””” Issued as people prepared to observe the anniversary of London suicide 


bombings and loss of life one year previous in 2005, this Tanweer videotape and an 
accompanying video statement from Ayman al-Zawahri indicated further an al-Qaeda 
inspired motive for the July 7, 2005 bombings. 


The Media Moment 


The London bombings presented cellular telephone images and information in near real-time 
from victims and from people in the immediate vicinity of the attack sites. Although this 
forum for “citizen journalism” existed well before July 2005, most notably during the 
December 2004 tsunami, the quality of personal accounts and insight improved greatly in the 
hours and days following the London subway and bus bombings. 


Web sites of broadcasting corporations or 
syndicated newspapers provided a means 
to submit eye-witness accounts by 
common citizens, while news reporters 
developed complementary news 
vignettes. Rather than drowning 
interested people in a tidal wave of 
miscellaneous information and opinion, 
the London incident proved that this type 
of journalism could be focused and edited 
in a concise and meaningful way.”” 


Camera phones presented near-immediate — Figure 5-17. Cellular Telephone Photo- 
images to a general public that otherwise Image of Subway Tunnel Evacuation 
would not have been possible. When (Source: William Alfano, London Public Transportation 

noe : P e Explosions, 7 July 2005, Western Europe Regional 
victims at the bomb sites, in particular the —_ Coordinator. OverseasSecuritv Advisorv Council. n.d.) 
subway train cars and tunnels, sent video 
clips of the terrorist attacks to news channels or family members, they provided the first 
actual recordings of damage magnitude.*®’ This news gathering technology offers exceptional 
capabilities during future incident use by emergency responders, transportation coordinators, 
law enforcement, and other government authorities and services. 


The Public Response 


Condemnation of these terrorist acts was immediate. UN Secretary Kofi Annan stated that the 
bombings as “an attack on humanity itself.” The UN Security Council condemned the 
terrorism without reservation and urged nations to prosecute the terrorists for such “barbaric 
acts.” Many prominent religious leaders and organizations voiced similar disgust. Grand 


278 BBC NEWS, “Video of 7 July bomber released;” 6 July 2006; available from 
http://news.bbc.uk/2/hi/uk_news/5154714.stm; Internet; accessed 6 July 2006. 

*7° Robert MacMillan, “Witnesses to History,” washingtonpost.com, 8 July 2005; available from 

http://www. washingtonpost.com/wp-dyn/content/article/2005/07/08/AR2005070800584.htm!]?refer...; Internet; 
accessed 8 July 2005. 

280 James Owen, “London Bombing Pictures Mark New Role for Camera Phones, “11 July 2005; available from 
http://news.nationalgeographic.com/news/2005/07/0711_ 050711 londoncell.html; Internet; accessed 9 Feb 2006. 
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Mufti of Saudi Arabia, Sheikh Abdul Aziz Al-Asheikh, declared that “...Killing and 
terrorizing innocent people and the destruction of property are not condoned by Islam.” The 
Muslim Community of Britain exemplified several groups by condemning the indiscriminate 
acts of terror.®! 


Queen Elizabeth and members of the royal family were very visible in visiting hospitals and 
staffs, victims of the attacks, emergency responders, and general citizenry in the hours and 
days following the terrorist attacks.” 


In the context of the Global War on Terrorism, President Bush commented on the London 
bombings: “These attacks were barbaric, and they provide a clear window into the evil we 
face...The aim of the terrorists is to remake the Middle East in their own grim image of 
tyranny and oppression by toppling governments, by exporting terror, by forcing free nations 
to retreat and withdraw.” Bush stated the requirement for offensive action to deter or deny 
acts of this type of terror against the United States. “The best way to protect the homeland is 
to go on the offense, is to find these people in foreign lands and bring them to justice before 
they come here to hurt us.”””’ Appeasement, a failed political option in a previous century, is 
not an option. “These kind of people who blow up subways and buses are not people you can 
negotiate with, or reason with, or appease.””°* Correspondingly, Bush acknowledged that, 
“We know that there is no such thing as perfect security, and that in a free and open society it 
is impossible to protect against every threat.” 


Prime Minister Blair announced, “...I say to our Muslim community. People know full well 
that the overwhelming majority of Muslims stand four square with every other community in 
Britain. We were proud of your contribution to Britain before last Thursday [bombings]. We 
remain proud of it today. Fanaticism is not a state of religion but a state of mind. We will 
work with you to make the moderate and true voice of Islam heard as it should be.”*®? Other 
salient comments reflected the terrorist acts in their basic definition: “There can be no way 
that anyone can say that there can be an ideology or faith that underpins this act [bombings], it 
is simply a criminal attempt at mass murder.”*”° 


Case Discussion Questions 
Intelligence and Threat Warning? 


e What activities preceding the July 2005 attacks might have indicated the intent of the 
terrorists to attack a major city population and its infrastructure? 


*81 «Response to the 2005 London bombings, Multinational bodies; Religious response,” Wikipedia; available 
from http://en.wikipedia.org/wiki/Resonse_to_the_ 2005 London bombings; Internet; accessed 26 January 2006. 
*8 «Response to the 2005 London bombings, Royal family,” Wikipedia; available from 
http://en.wikipedia.org/wiki/Resonse_to_the 2005 London bombings; Internet; accessed 26 January 2006. 

*83 Jim Vandehei, “Bush Defends Strategy Against Terrorist Attacks,” Washingtonpost.com; 12 July 2005; 
available from http://www.washingtonpost.com/wp-dyn/content/article/2005/07/11/AR2005071101331.html; 
Internet; accessed 23 January 2006. 

*4 Thid. 

a Tony Blair, “Prime Minister’s Response to the London Bombing, (Delivered to Parliament, London, England, 
11 July 2005). 

°86 «Commissioner and Mayor hold press conference;” available from 

http://www. london.gov.uk/news/2005/bombimgs-statement-080705.jsp; Internet; accessed 23 January 2006. 
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e Did specific extremist activities in the United Kingdom indicate a security risk to UK or US 
national interests in the UK? 


e Why did the terrorists select the London subway system as a target? 
e Why did the terrorists select the London bus system as a target? 
Security Measures in Effect? 


e How did United Kingdom national laws relating to freedom of speech affect the 
forum of discussion and dissent concerning religious extremism? 


e What centralized command and control procedures existed among UK civil government- 
military organizations for emergency response to a catastrophic incident? 


e Were adequate security measures in place at the train-subway stations? What role do police 
have in force protection activities? What is the role of the law abiding citizen? 


Terrorist Tactics, Techniques, and Procedures? 


e What precedents in domestic terrorism in the United Kingdom could have focused 
government awareness and counter actions? 


e How did the terrorists acquire and manufacture the improvised explosive devices? 

e What type of rehearsals did the teams conduct for the attack? 

e What was the terrorist rationale for using backpacks to deliver the bombs? 

e How could terrorists have increased mass casualty effects as even more devastating? 


e How did the terrorist cell structure itself, communicate, and operate during the phases of 
final planning, rehearsals, and execution of the attacks? 


e What implications exist for the conduct of domestic terrorism by citizens or naturalized 
residents of Western nations? 


Assessment 


What motivation existed for the suicide bombing attacks of July 7, 2005? The Khan videotape 
cites his commitment to an extremist viewpoint in a religious duty. He attempted to state a 
moral basis for his actions. He aligned himself philosophically with and praised notorious al- 
Qaeda regional and transnational leaders. 


A likely rationale for targeting London is the United Kingdom presence as the second largest 
Coalition Force in Iraq and a strong ally with the United States. Khan, in his suicide 
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videotape, calls himself a soldier at war and criticizes “...democratically elected 
governments...” Furthermore, Khan declares a plan for vengeance. 


But why was this particular day in July selected for the attack? The G-8 Summit scheduled in 
Scotland during this period may have been a consideration, but the bombings did not display 
any significant disruption to its agenda or outcomes. Yet, the value of this terrorist action 
might be realized in context of a larger strategic, long-term, extremist outlook. To gain 
momentum in highlighting perceived wrongs and seek general acknowledgement of 
grievances, there must be action. The lack of a credible claim of responsibility immediately 
following the attacks suggests that Khan may have operated in a loosely confederated or 
semi-independent manner. 


Nonetheless, public business and transportation experienced temporary disruption. Some 
official announcements recommended that Londoners consider not going to work for a period 
of time; some theaters or other gatherings closed temporarily for business. People reported 
suspicious incidents that perked apprehension of other bombing attacks. Although these 
observations turned out to be false alarms, these reports averaged about ten temporary 
closures of stations or lines per day for a week.”*” The London bombings echo an expectation 
of confusion and unintentional errors in initial information announcements, congested mobile 
telephone services, disrupted traffic patterns, and security cordons,** as well as general 
anxiety in normal everyday actions. 


The Mayor of London used the media to make an immediate statement to the terrorists: “In 
the days that follow, look at our airports, look at our seaports and look at our railway stations 
and even after your cowardly attack, you will see that people...will arrive in London to 
become Londoners and to fulfill their dreams and achieve their potential. They choose to 
come to London,...because they come to be free, they come to live the life they choose, they come 
to be able to be themselves. They flee you because you tell the how they should live. They don’t 
want that and nothing you do, however many of us you kill, will stop that flight to our city where 
freedom is strong and where people can live in harmony with one another. ..”*°” 


Concerning the daily lives of Londoners, the Prime Minister noted “...just four days later, 
London’s buses, trains, and as much of its underground [subway] as possible, are back on 
normal schedules; its businesses, shops and schools are open; its millions of people are 
coming to work with a steely determination...” In fact, although the London Underground 
[subway] was closed in the hours following the bombings, much of the city service was 
operating by the next day. Those lines damaged by the explosions remained inoperative until 
repairs and initial crime scene investigation were completed. Similarly, most bus lines were 


*87 Maria Rasmussen, “Some Thoughts on the London Bombings,” Strategic Insights, Center for Contemporary 
Conflict, [V, no. 9 (September 2005); available from 
http://www.ccc.nps.navy.mil/si/2005/Sep/rasmussenSep05.asp; Internet; accessed 2 February 2006. 

*88 Sarah Veysey, “London bombings show need for crisis plan updates,” Business Insurance, 39, no. 40, (3 
October 2005) [Proquest database]; available from 
http://proquest.umi.com/pdqweb?index=11&did=910289131&SrchMode=1&sid=1&Fmt=...; 

Internet; accessed 25 January 2006. 

89 Thid. 

aay Tony Blair, “Prime Minister’s Response to the London Bombing,” (Delivered to Parliament, London, 
England, July 11, 2005), Vital Speeches of the Day, 0042742X, 7/15/2005, 71, Issue 19. 
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operating normally by the next day with the exception of selected central London areas. For a 
period, surface trains operated with adjusted access ability into London.” 


Attacking central London may have been a symbolic gesture against an economic district of a 
major European city. The disruption of transportation was a practical temporary impact 
on the population and commerce, but impact on the overall economy and markets was 
marginal if not minimal.*” Shortly after the 7 July London suicide attacks, one assessment 
from a subject matter expert consortium in Washington, D.C. posed several issues for 
consideration as analysis of the terrorist acts continued. Tactics and techniques may be 
adapting from previous sensational attacks. The bombers were “home-grown,” that is, citizens 
of the UK. Yet, attention should focus also on “...the importance of networks aiding trans- 
boundary movement and implicitly aiding recruitment by appeals to non-territorial forms of 
identity...” Other comments suggest that a new generation of terrorist, with little personal 
experience in war-torn regions of the world, may be evolving from Salafi-Jihadist movement 
support, and be less likely linked to a formal al-Qaeda organization.””’ One claim of responsibility, 


from a group declaring affiliation with al-Qaeda, described a “burning cross” which may have been 
294 


the expectation of explosions at cardinal points along the subway system. 


Implications 
for the United States 


What terrorist concerns loom in the 
future for the United States? The Federal 
Bureau of Investigation knows that 
transnational networks such as al-Qaeda 
remain committed to attacking the 
United States. Relatively simple, low- 
technology type weapons are the most 
likely means available to cause mass 
casualties and economic disorder. The 
US transportation system is a key Figure 5-18. New York City Mass Transit 
terrorist target.”” System and Daily Living 

(Source: http://images.google.com...www.alertnet. 

org/thefacts/ imagesrepository/RTR) 


**! “Response to the 2005 London bombings, Security responses in the UK,” Wikipedia; available from 
http://en.wikipedia.org/wiki/Resonse_to_the 2005 London bombings; Internet; accessed 26 January 2006. 
°° David Wyss, “Where Terror Hurts Less,” Business Week, 11 July 2005; available from 
http://www.businessweek.com/investor/content/jul2005/pi20050711_ 5798 _pi077.htm; Internet; accessed 23 
January 2006. 

*°° Cerwyn Moore and Murad Al-Shishani, “The Jihadist Movement after London: Diverse Backgrounds, 
Common Ideology,” Terrorism Monitor; 3, no. 15, (28 July 2005); available from 
http://jamestown.org/terrroism/news/article.php?articleid=2369754; Internet; accessed 8 August 2005. 

* «British Police Sources Say Terrorists carried Out Rehearsal of London Bombing,” World News, 20 
September 2005, [EBSCO Host, Research Databases]; available from 
http://web17.epnet.com/citation.asp?tb=1&_ugsid+7FDF469B%2DEB1D%2D461A%2D...; Internet; accessed 
25 January 2005. 

25 Robert S. Mueller III, “Congressional Testimony of Robert S. Mueller III, Director, Federal bureau of 
investigation Before the Senate Committee on Intelligence of the United States Senate,” 16 February 2005; 
available from http://www.fbi.gov/congress/congress05/mueller021605.htm; Internet; accessed 10 March 2006, 
3. 


9-24 


TRADOC G2 Handbook No. 1.01, Terror Operations: Case Studies in Terrorism 25 July 2007 


Why attack public transportation systems in the United States? Terrorists attack targets with 
an expectation of success; notoriety feeds on anxiety, fear, and mass casualties. Soft targets 
such as tourist sites, resorts, restaurants, hotels, residential compounds, synagogues, city 
streets, buses, trains, and subways are vulnerable. Other aspects favor an attack: public 
transportation centers offer easy access and escape, if escape is a planning factor. Contained 
environments increase the effects of explosives and the likelihood of panic and mayhem after 
an attack.*”° Transportation systems normally concentrate people; these concentrations 
increase the probability of mass casualties and effects. 


The greatest concerns in preventing a catastrophic terrorist incident are (1) the threat of covert 
operatives, whether a sleeper-type cell or a recently recruited operative, inside the US with an 
intention to assist or conduct a terrorist attack; (2) the clear intention of al-Qaeda to obtain 
and use a weapon of mass destruction??” against the US; and (3), the potential for al-Qaeda to 
leverage other extremist persons or groups to assist or conduct attacks on the United States.*”° 


US domestic terrorists and other international terrorist groups pose a threat too. Political and 
social agendas include white supremacy, black separatism, animal rights, environmental 
protection, anarchism, anti-abortion, right-wing Patriot movement themes, and ethnic 
homeland or religious ideology themes.” In a recent instance, the FBI uncovered an alleged 
terrorism plot by Americans to target synagogues and military recruiting centers around the 
Los Angeles area.*”’ The London bombings indicate that a person can take an extreme concept, 
and recruit targeted individuals into a small group of committed terrorists. He can gather and 
provide the means for making and delivering devastating weapon effects, and attack while 
attempting to mask mass murder with a radical ideology and justification. 


The danger in the United States remains real. The largest mass transit systems in the US 
support New York City, Chicago, Los Angeles, Boston, and Washington, D.C. When Khalid 
Sheik Muhammed, a chief subordinate to Osama bin laden, was captured, he stated during his 
interrogation that al-Qaeda planned to attack the Washington, D.C. metro [subway] system.*”" 


Risk assessment and management is a colossal task for any of the transportation systems. For 
example, New York City has more than 7 million daily commuters using its network of buses, 
trains, and subways.°” Consider just the tunnel network of the New York City Metropolitan 
Transportation Authority. The transportation network includes 14 tunnels that link four of the 
city’s five boroughs under three bodies of water — the East River, the Harlem River, and Newtown 


°°6 Brian Michael Jenkins, “The Lessons of London” RAND Corporation Commentary, 17 July 2005. 


°°7 WMD: weapon of mass destruction or effects. WMD uses major categories of chemical, nuclear, biological, 
radiological, and high yield explosives (CBRNE). 
Robert S. Mueller III, “Congressional Testimony of Robert S. Mueller II, 16 February 2005, 4. 

Ibid., 6-7. 
309 «PP Interview: FBI’s LA boss says homegrown terrorists top concern,” MercuryNews.com; available from 
http://www.mercurynews.cim/mld/mercurynews/news/local/states/california/northern_cal...; Internet; accessed 
24 January 2006. 
°°! Daniel B. Prieto, “Mass Transit Security after the London Bombings,” Presentation Before the 
Commonwealth of Massachusetts, Joint Committee on Public Safety and Homeland Security, 4 August 2005, 3. 
3°? Angie C. Marek, “Trying to Keep New York Safe...”U.S. News and World Report, [QProquest database] 8 
August 2005, 139, no. 5, 25. 
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Creek.°°? In 1997, law enforcement uncovered and prevented an Islamic terrorist bomb attack 
on the New York City subway system.*”* Another terrorist attempt to bomb the New York 
City subway system was prevented in 2004 before the Republican National Convention.*”’ 


Immediately after the 7 July 2005 London bombings, the US elevated the Homeland Security 
Advisory System*” risk of attack level from Code YELLOW to Code ORANGE for the mass 
transit portion of the US transportation sector. Although no specific intelligence suggested a 
similar attack against the US transportation system, the belief that terrorism was a driving 
element of the London bombings, the possibility that al- Qaeda may be involved, and a typical 
al-Qaeda tactic of conducting nearly simultaneous attacks convinced Federal authorities that a 
high risk announcement was appropriate.°”” 


The United States security is not just a Federal responsibility. National strategy seeks to 
maximize security but acknowledges Americans’ rights, freedoms, prosperity, mobility, and 
individual privacy. Security is a network of systems spanning government and the private 
sector. Partnership includes federal, State, and local leadership; law enforcement at all levels; 
emergency responders such as incident management, firefighters, and medical technicians and 
doctors; international liaison; and of course, the general public.°”* 


Another collective way to assist in countering the distorted promotion of terrorism is to use 
descriptive terms in a deliberate manner. Intent follows a definition of terms. Labeling and 
describing the London bombers for what they are — mass murderers — denies the rhetoric of 
extremism and refutes any legitimacy of suicide or murder. Militant reinterpretation of 
religious dogma is at its best a misguided passion; at its worst, a criminal travesty.”°” 


Similar clarity accents the strategy that the United States uses to protect its people. Four key 
points shape this doctrine. First, the United States is proactive and remains on the offensive 
with the intention of defeating terrorists abroad in order to preclude terrorist attack in the 
Homeland. Second, the United States makes no distinction between the terrorist and the 


303 Sewell Chan, Kareem Fahim, and Colin Moynihan, “Since London Bombings, New York Has Guarded 
Underwater Subway Tubes Full Time,” New York Times, 20 July 2005, B.1. 

304 Elliot Blair Smith, Thomas Frank, Julie Schmidt, and Roger Yu, “Lessons from London Attacks, USA Today, 
7 July 2005; available from http://ww.usatoday.com/money/2005-07-07-terror-cover-unsat_x.htm; Internet; 
accessed 23 January 2006. 

%°° Michael Hedges, “Attacks resurrect concerns about U.S. mass transit safety,” Houston Chronicle, 8 July 
2005; available from http://www.globalsecurity.org.org/news/2005/050708-transit-safety.htm; Internet; accessed 
23 January 2006. 

36 «Threats and Protection,” Department of Homeland Security, Homeland Security Advisory System; available 
from http://www.dhs.gov/dhspublic/display?theme=29; Internet; accessed 16 March 2006. 

3°7 Michael Chertoff, “Transcript from Secretary Michael Chertoff Press Briefing on the London Bombings,” 7 
July 2005; available from http://www.dhs.gov/dhspublic/display?content=4577; Internet; accessed 16 March 
2006. 

308 Michael Chertoff, “Statement of Secretary Michael Chertoff, U.S. Department of Homeland Security, Before 
the United States Senate Committee on Commerce, Science, and Transportation,” 19 July 2005; DHS testimony 
is embedded in document by Merle D. Kellerhals, Jr., “TERRORISM: Documents & Texts from the Washington 
File, 19 July 2005, Chertoff Says London Bombings Are Forceful Reminder of Threat;” available from 
http://www.usembassy.org.uk/terror583.html; Internet; accessed 15 March 2006. 

309 «Mfurderers are not martyrs — terror in London,” The Australian, [EBSCO Host, Research Databases], 16 July 
2005; available from 
http://web17.epnet.com/citation.asp?tb=1&_ug=sid+7FDF469B%2DEB1D%2D461A%2D....; Internet; accessed 
25 January 2006. 
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countries that harbor them. Both are an enemy of the US. Third, the United States will 
confront threats before they fully materialize. Fourth, the United States advances the security 
of the Homeland by advancing the cause of freedom across the world. This advance of 
freedom is vital to US security and depends on the advance of liberty in other nations.*"° 


We remain a nation at war...We will take this fight to the enemy without wavering, and 
we will prevail ...they’re [terrorists are] trying to break our will with stunning acts of 
violence. The terrorists do not understand America. They’re not going to shake our will. 
We will stay in the hunt, we will never give in, and we will prevail.’"' 


George W. Bush 
The President 
United States of America 


Future Trends? 


This case study discussed terrorist method, 
means, and rationale in the London bombings 
of July 7, 2005. The apparent localized 
planning and conducting of these four attacks 
suggest several trends in future acts of 
terrorism. First, suicide bombing and the tactic Z00m,jSp?xx=2809775) 

of nearly simultaneous, multiple site attacks 

will continue to occur and remain a significant threat. Combined with motivational extremism 
by terrorists, these suicide-homicide attacks will be very difficult to combat and counter, 
especially with the flexible organizational structure of loose confederations or semi- 
independent terrorist cells. Second, terrorist’s intent on gaining shocking psychological 
effects with mass casualties and mass media coverage will attack soft-type targets such as 
transportation networks and the corresponding high density of people usually located in these 
confined areas. Third, weapon effects beyond the destructive power of conventional explosives 
will be magnified as terrorists seek, acquire, weaponize, and use chemical, biological, 
radiological, or nuclear capabilities. Fourth, attacking vulnerabilities that cause calamity and 
catastrophic economic consequences for the US will remain a primary aim of al-Qaeda. 
Expanding transnational associations with localized terrorist cells amplify this capability. 
Finally, future terrorist attacks will not be analyzed as only discrete events, but will be examined as 
episodes in a long war that will be measured not in days and months, but in years and decades — a 
Global War on Terrorism. 


Figure 5-19. UK Prime Minister Blair 
and US President Bush 
(Source: http://wiadomosci.gazeta.pl/aliasy/mod/ 


31° George W. Bush, “President Addresses American Legion, Discusses Global War on Terrorism,” 24 February 
2006; available from http://www.state.gov/r/pa/ei/wh/rem/62075.htm; Internet; accessed 10 March 2006, 3. 
311 . 

Ibid., 2. 


5-27 


TRADOC G2 Handbook No. 1.01, Terror Operations: Case Studies in Terrorism 25 July 2007 


This Page Intentionally Blank 


5-28 


TRADOC G2 Handbook No. 1.01, Terror Operations: Case Studies in Terrorism 25 July 2007 


Chapter 6: Beslan: Hostage Crisis and Mass Murder 


The morning of September 1, 2004 started as a community day of celebration in Beslan, 
an industrial-agricultural town in the Russian Republic of North Ossetia/Alania. Children 
and parents were preparing for the first day of the school season in the Caucasus, a day 
known as “First September” or the “Day of Knowledge.” Opening ceremonies for school 
would include first-year students giving flowers to those students beginning their final year of 
school, followed by a procession at the school. Parents and relatives were ready to attend the 
ceremonies of opening day to share their pride in observing sons, daughters, nephews, and 
nieces at this educational milestone. 


Figure 6-1. Beslan Hostage Crisis and Mass Murder by Terrorists 


But happiness turned to confusion, and spiraled abruptly to horror as a vehicles drove to 
the school courtyard. A group of about 30 individuals in camouflage and civilian 
clothing, their faces covered with masks, jumped from vehicles or nearby areas and 
started barking orders. Some of the parents thought the display must be security forces 
practicing a counter-terrorism drill. Yet, immediate anxiety rippled through the crowd. 
Some people wanted to believe the first popping noises were balloons as part of the 
celebration. But something was terribly wrong. Weapons were being fired into the air and 
ground; people were being pushed and shoved; some people were shooting at each other. 
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Assault rifle gunfire shocked everyone to the reality that they were in the midst of a 
terrorist incident and being herded into the school. 


This premeditated hostage crisis spanning almost three days would result in the mass 
murder of over 300 men, women, and children. Several hundred other citizens were 
wounded or psychologically traumatized by the ordeal. Some actions by Russian 
authorities contributed to the loss of life and trauma in this incident. A group of terrorists 
used these criminal acts to gain international attention and seek political concessions from 
the Russian Federation concerning Chechnya. The terrorists wanted to also embarrass 
Russian authorities with the apparent inability of Russia to protect its citizens from 
terrorism. Recognizing terrorism as a criminal act, terrorism and terrorist will be the 
terms normally used throughout the case study. 


This case study presents an unclassified summary of terrorist motivations and actions of 
an attack on a city middle school. Phases assess planning and preparation, tactics and 
techniques, and immediate aftermath of the hostage crisis and intentional murders. Other 
vignettes highlight local emergency response and medical treatment of victims, media 
manipulation and restrictions, dysfunctional negotiation opportunities, Russian governmental 
security lapses and command and control gaps, and conduct of Russian military and security 
forces. (See Table 6-4, Chronology of Beslan: Hostage Crisis and Mass Murder.) 


As a Caveat, descriptions of events at Beslan remain clouded in controversy. Even after 
official commission studies, investigative reporting and eye witness or hostage interviews 
by numerous organizations, sequences of action and what actually occurred are often 
marred by suspicion or proof of intentional false statements, or the perception of what a 
particular person may recall of a traumatic situation. At best, this case study can provide 
generalized timelines, numbers, and a common account of the terrorism at Beslan. 


Introduction 


Hostage taking has a special place in the terrorism arsenal...they 
conduct large-scale terrorist actions involving hostage taking.”'* 


Colonel Sergey A. Kulikov 


A primary underlying aim of terrorism is a demoralizing psychological effect on a 
target population and its leaders, often with explicit media coverage of mass 
casualty effects to erode public resolve and enhance terrorist objectives. 


3” Sergey Kulikov, translated by Robert Love, “Insurgent Groups in Chechnya,” Military Review 83 
(November-December 2003): 24, 28. Sergey A. Kulikov was a special forces battalion commander in the 
Russian Ministry of Internal Affairs (MVD) during the Second Chechen War, and was a liaison officer 
between the Russian Ministry of Defense Armed Forces and Russia’s MVD during the First Chechen War. 
His father, General Anatolly Kulikov, was at one time the commander of all Russian forces in Chechnya. 
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Beslan and the war in Chechnya are inseparable events in perspective. Whether 
domestic or international in scope, terrorism was and remains part of a strategy that 
sometimes erupts as part of an operational campaign or specific tactic. Russian 
President Yeltsin commented on terrorism and Chechnya in 1999: 


Our country is waging a difficult battle against international 
terrorism, which has blatantly thrown down the gauntlet before us. 
This is a fight for the life of the people of Russia, many of whom we 
lost in Moscow and Dagestan, in Volgodonsk and Buynaksk. This is a 
fight for the sovereignty and territorial integrity of the Russian 
Federation. It is also part of the international community’s effort 
against international terrorism. I am sure that those in the West who for 
some reason have still not understood this will be convinced that we are 
in the right. International terrorism has no borders. It now has the 
whole world in its sights. °° 


President Boris Yelstin 
December 1999 


In subsequent years, statements by other senior Russian officials emphasized the 
main threats to Russia’s security as religious extremism, separatism, and 
international terrorism. Russia‘s campaign for international action against terrorism 
spanned national, regional and global cooperation.’'* Shortly after the terrorist 
attack on the USA on September 11, 2001, Russian President Putin stated: 
“Terrorism and religious extremism of various denominations today pose the main 
threat to peace.”*» 


Acts of terrorism can have an effect of demoralizing a population; however, 
terrorism can also fortify the resolve of a population. The immediate public outrage 
in Beslan, in the Russian Federation, and among many nations of the world 
illustrates the impact from such a hostage crisis and mass murder. Tactical success 
or failure at such an incident can have a corresponding offset for both governmental 
authorities and terrorists. The notoriety that such a devastating tactical event can 
have on either government policy or terrorist intent can significantly improve or 
diminish its value on operational or strategic goals. Russian authorities displayed 
several significant flaws in incident response, negotiations, and tactical conduct. 


In the Beslan incident, issues of questionable confidence or outright unbelief by 
local citizens in governmental announcements and procedures, and _ terrorist 
perceptions of expected operational conduct by government forces based on previous 


313 Mark Smith, “Russian Perspectives on Terrorism,” Conflict Studies Research Centre, Defence Academy 
of the United Kingdom, January 2004, 3. 

314 Thid., 4. 

3! Thid., 10. 
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counter-terrorist scenarios, further complicated an already critical situation. How would 
the Russian government respond to this crisis? Did the terrorists achieve their stated 
or intended objectives? Would the terrorists negotiate? 


A statement by Russian President 
Vladimir Putin shortly after the 
crisis addressed issues of sympathy 
as well as analysis of operational 
security deficiencies at Beslan, and 
measures for improved future 
security, crisis management, and 
law enforcement. In a declaration 
concerning terrorism, Putin stated: 


Figure 6-2. Russian President Putin 


... Lhe terrorists believe that they are stronger than we are. That 
they will be able to intimidate us with their brutality, paralyze our 
will, and demoralize our society...We are not dealing merely with 
separate acts of intimidation and isolated terrorist sorties. We are 
dealing with direct intervention against Russia by international 
terrorism, with an all-out, brutal and full scale war that, over and 
over again, keeps taking the lives of our companions. All the world 
experience shows that such wars, unfortunately, do not end quickly...We 
must create a much more effective security system and demand that 
our law enforcement agencies take actions commensurate with the 
level and magnitude of the new threats that have emerged...°”° 


President Vladimir Putin 
September 4, 2004 


Learning Objectives 


Learning objectives focus on analyzing case study information in order to synthesize and 
evaluate insights from this attack, discern patterns of terrorist method and means, and 
determine likely trends in contemporary terrorist activities. Comparing and contrasting 
conditions, circumstances, and asymmetric options available to the government authorities 
and the terrorists can enhance judgment to recognize vulnerabilities, identify threats, and 
minimize the ability of terrorism to affect a targeted activity or organization. 


Terrorism is a reality of the Contemporary Operational Environment (COE) and will 
remain a significant threat for the foreseeable future. Terrorists may target susceptible 


316 «Beslan Hostage Crisis Ends in Disaster,” The Current Digest of the Post-Soviet Press 56 no. 35 (October 6, 
2004): 5. 
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people, symbols, capabilities, and infrastructure to enhance terrorist objectives and 
diminish the resolve of an adversary. Attacks may occur while U.S. military forces are in U.S. 
homeland, in transit to and from missions, and during operational deployments around the 
world. Other organizations or citizenry are potential terrorism targets. The objectives for this 
case study are: 


e Describe intelligence indicators that might have been analyzed to create a 
more effective tactical estimate of terrorist intention and capability in the 
Beslan hostage crisis and murder of civilian men, women, and children. 


e Understand the terrorist’s motivation of choosing the population of Beslan and 
a community school celebration as a terrorist target of high value. 


e Recognize aspects of force protection or security measures that could apply in 
domestic terrorist threats to U.S. forces or citizenry in the United States 
homeland and abroad. 


e Explain terrorist organizational structure and tactics, techniques, and 
procedures (TTP) used for the Beslan attacks. 


e Deduce possible trends for terrorist acts with the objective of mass casualties 
and international media attention. 


Case Study — Beslan: Hostage Crisis and Mass Murder (2004) 
Background 


The Caucasus lies located between the Black Sea and Caspian Sea. This region has experienced 
ethnic-religious rivalries for centuries. Characteristics continue to highlight the importance of 
local politics, economics, and motivations of separatism, independence, and regional power. 
More recently, this regional land bridge between southeast Europe and western Asia 
illustrates the aftermath of oppressive Soviet policy in the mid-twentieth century. Stalin 
ordered mass deportations of ethnic populations such as the Checheno-Ingush for alleged 
collaboration with the Nazi regime during World War II.°'’ Russian authorities 
incorporated much of the region into the Russian Republic of North Ossetia. By the late 
1950s, the Checheno-Ingush people were allowed to resettle in their former homeland, 
but found some geographic areas and former properties were retained by North Ossetia. 
An additional friction is a predominantly Christian population in North Ossetia with 
much of the surrounding region home to Muslim populations.°'® 


317 Jean-Cristophe Peuch, “Russia: Beslan Hostage Crisis Rekindles Tensions Between Ossetians And 
Ingush,” 8 September 2004; available from http://www.rferl.org/featuresarticle/2004/09/67ae802c-02ea- 
4355-ae81-61b056401483.html; Internet; accessed 19 January 2007. 

318 Nabi Abdullaev, “Beslan, Russia... Terror! in the Schoolhouse,” Homeland Defense Journal 3 
(September 2004): 28. 
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Figure 6-3. Above, Left Russian Caucasus and Area of Interest (box added) 


Figure 6-4. Above, Right North Ossetia and Beslan (outline added) 
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Figure 6-5. Above, Left. Beslan Map (Out of Date) (box added) 
Figure 6-6. Above, Right. Beslan Overhead Image (outline added) 
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As the Soviet Union disintegrated, simmering issues of the Ingush people to reclaim 
former land and property in North Ossetia boiled to the surface. By 1992, a short conflict 
between the Ingush and North Ossetians caused an estimated several hundred to several 
thousand deaths before Russian forces stopped the fighting.*'? Thousands of people were 
displaced due to the short war.°*? Chechnya, a neighboring region, had declared its 
independence from Russia in late 1991. Russia struggled to maintain sovereignty in 
Chechnya and eventually moved military forces into Chechnya in December 1994. Two 
years of war offered mixed outcomes. Russia had lost the information war of public 
opinion to Chechen fighters. However, Russian authorities learned from this failure and 
promoted a compelling image of regional criminal activity, political extremism, and 
terrorism as counter to Russian security. Issues such as regional kidnapping, hostage 
taking, slavery, slave trading, and oil theft were publicized as were numerous raids and 
bombings being conducted by criminals, extremists, and terrorists. Russian public opinion 
appeared to shift dramatically in favor of an “iron hand” after a Chechen separatist, Shamil 
Basayev, conducted a series of attacks in nearby Dagetsan, and a series of bombs attributed to 
Chechen terrorists exploded in apartment complexes in Moscow and other Russian cities.°*! 


Russia considered the Dagestan attacks part of a larger separatist aim to destabilize 
republics adjacent to Chechnya such as Dagetsan and Ingushetia, as well as the entire 
Caucasus area.” Basayev’s August 1999 raid into Dagestan by a Chechnya-based and 
self-proclaimed Islamic International Peacekeeping Brigade (IIPB) was one of the 
contributing factors igniting the Second Chechen War in 1999. Russia deployed more 
military forces to Chechnya. By mid 2000, Russia established direct rule of Chechnya. 
Eventually defeated in conventional large scale operations in urban and mountainous 
areas by Russian forces, separatists and other insurgent groups concentrated on small 
scale raids, bombings, and terrorism. By early 2003, Russia provided a large degree of 
autonomy to Chechnya with Russia still clearly in control of the republic.*”* 


Mass hostage-taking was recognized as being a particularly effective tactic for gaining 
media attention. The 2002 civilian hostage crisis in a Moscow theater kept the Chechen 
separatist movement and discussion of Islamic extremism in the spotlight.°°* The 
terrorists claimed the approval of Shamil Basayev, one of the more notorious of Chechen 
terrorists. The mass casualty outcome of the Moscow theater crisis, criticism of Russian 


31 Jean-Cristophe Peuch, “Russia: Beslan Hostage Crisis Rekindles Tensions Between Ossetians And Ingush.” 


°° Mark Galeotti, “Beslan shows growing Islamist influence in Chechen war,” Jane’s Intelligence Review, 
October 1, 2004, available from 
http://www8.janes.com/Search/documentView.do?docld=/content1/janesdaat/mags/jir...; Internet; accessed 
8 January 2007. 

2! Emil Pain, “The Second Chechen War,” Military Review, 80 (July/August 2000), EBSCOHOST, 
3420269, available from http://web.ebscohost.com/ehost/detail?vid=1&hid=107&sid=2545b582-8eff...; 
Internet; accessed 8 January 2007. 

322 CW. Blandy, “North Caucasus: Escalation of terrorism into Ingushetia,” Conflict Studies Research 
Centre, Defence Academy of the United Kingdom, Caucasus Series 4/17, 1. 

°°3 Wikipedia, “Second Chechen War: Restoration of federal government,” available from 
http://en.wikipedia.org/wiki/Second_Chechen_War; Internet; accessed 26 January 2007. 

34 Mark Galeotti, “Chechen militants bring their war to Moscow,” Jane’s Intelligence Review, December 
01, 2002; available from http:/Awww8.janes.com/Search/printFriendly View.do?docld=/content1/janesdata/...; 
Internet; accessed 8 January 2007. 
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security counter-measures, and flawed Russian tactical conduct added grist to an already 
expanding terrorist information operations mill. Yet, closer inspection between terrorist 
political goals and extremist religious sanction could identify significant differences in 
pragmatic politics, moderate Islamic views, and radical separatist actions. 


Shamil Basayev found himself hailed as a “freedom fighter” or defamed as a criminal and 
“bandit.” Terms mean different things to different people. In the region, the term boeviki 
can be translated as “fighter” or “separatist fighter,” or can be defined as “terrorist 
militant” as often expressed by Russian officials.*”? Support of Basayev’s extreme actions 
from Chechen leaders and nationalists shuttled among recognition as military ally, an outlaw, 
or as a distant political associate. 


Terrorist operations in 2003 and 2004 displayed increased activity and marked tactics to 
gain international attention of ethnic, political, and Islamic extremist disputes. A suicide 
bomber attempted to assassinate the Ingushetia President in April 2004. In May 2004, the 
Russian-backed President of Chechnya was assassinated in Grozny, Chechnya by a bomb 
placed under the seats in a stadium.*”° 


Political tension and brokering for power destabilized the region once again. Attacks and 
incidents in Ingushetia and Dagestan continued. In June 2004, well-armed and organized 
militants from Chechnya attacked Nazran the capitol of Ingushetia, and specifically sought 
and killed local law enforcement officers, occupied government buildings, searched for 
government officials, and ambushed reinforcing law enforcement convoys. Shamil Basayev 
was in the news once again.” 


Connection among Chechen criminal activity, insurgency, and terrorism is well known in 
the Caucasus region and very difficult to stop or deter. Kinship and a culture of violence 
in the region fans criminal acts such as protection rackets, kidnapping, counterfeiting, 
forgery, and illegal oil trade.°*® The same bonds of kinship and fear of reprisal minimize 
any real success of regional law enforcement or Russian security forces penetrating these 
groups that often blur the distinction among criminal, insurgent, and terrorist. 


Would another spectacular act of terrorism break the resolve of the Russian Federation 
and the will of the Russian people as a whole? Could another localized Caucasus event 
demonstrate the inability of Russia to protect its republics? Should a civilian hostage 
crisis be conducted on a heretofore unprecedented scale of terror? 


°° «Tracing a tragedy,” The Guardian, September 30, 2004; available from 

http://www. guardian.co.uk/russia/article/0,2763,1315930,00.html; Internet; accessed 19 January 2007. 
°° Seth Mydans (New York Times), “Killing puts Putin in a bind,” Marin Independent Journal, 12 may 
2004; available from http://www.marinij.com/Stories/0,1413,234~24410~2141111,00.html; Internet; 
accessed 12 May 2004. 

°°7 «Tracing a tragedy,” The Guardian, September 30, 2004; available from 

http://www. guardian.co.uk/russia/article/0,2763,1315930,00.html; Internet; accessed 19 January 2007. 
3°8 Nabi Abdullaev, “Chechnya’s organized crime-rebel nexus,’ International Relations and Security 
Network, 7 June 2005; available from http://www. isn.ethz.ch/news/sw/details.cfm?ID=12047; Internet; 
accessed 15 November 2006. 


6-9 


TRADOC G2 Handbook No. 1.01, Terror Operations: Case Studies in Terrorism 25 July 2007 


The Terrorists — A Huge Cauldron is Simmering 


To understand part of the regional terrorist threat that assaulted Beslan, two cultural 
traditions of adat and teip are fundamental to individual and group outlook on actions. 
Adat is a traditional concept of retribution or revenge. Teip is the tradition of clan or tribe and 
the allegiance required to an extended family and its ancestral lands.*” Such concepts 
compel groups with a sense of separatism or independence from external influences, and 
expect guidance from group elders, as well as protection of their culture by their young men. 


Former Ingush President Ruslan Aushev once compared the region as “...a huge cauldron 
is simmering there, in which there is Chechnya, and Dagestan, and Ingushetia, and 
Karardino-Balkaria, and Georgia, and each will be seeking its own interests.”*°° In 
addition to ethnic rivalries, radical forms of Islam are appealing to some in the region and 
may offer a personal meaning or supposed acceptance in a much larger religious context. 


Well before 2000, the Russian Federation was facing the specter of increasing terrorism 
and categorized three main types of terrorism: social terrorism with the aim of political 
and economic change, nationalist and ethno-separatist terrorism, and religious terrorism. 
By 2000, the threats of religious extremism and separatism were combining with 
international terrorism as Russia’s main threats. Russia announced similar statements 
after the terrorist attacks on the United States in September 2001.**' Russia experienced 
an increasing degree of Islamic radicalism in a number of terrorism incidents, and if not a 
primary incentive in specific terrorist group goals, was at least contributing to regional 
instability and extremism. 


Profile of a Terrorist 


Shamil Basayev, who claimed overall terrorist responsibility for the Beslan attack, 
supported terror for aims including separatist, political, and religious reasons. His 
personal history is interwoven in the turmoil of Russia after the demise of the Soviet 
Union and the rising expectations of Caucasus regional republics in the new Russian 
Federation. Basayev was involved in regional 
insurgent activities and ethnic fighting as early as 
1991. He gained notoriety during a 1991 hijacking 
of an airplane that placed a temporary media 
spotlight on Chechnya, and later, he acted as a 
key insurgent leader in the fighting in and around 
Grozny during the First Chechen War. After his 
wife, two of his children, and several other family Figure 6-7. Basayev 


a Timothy L. Thomas, “The Battle for Grozny: Deadly Classroom for Urban Combat,” Parameters, 29, 
(Summer 1999): 87-103. 

33° Mark Galeotti, “two wars, not one,” The World Today, 60, (November 2004), 17-18; available from 
ProQuest, http://proquest.umi.com/pqdweb?did=731118921&Fmt=4&clientld=417&RQT...; Internet; 
accesses 8 January 2007. 

331 Mark Smith, “Russian Perspectives on Terrorism,” 2, 4, 10. 
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members were killed in a 1995 Russian bombing raid on his home village, Basayev led 
an insurgent group that resulted in a mass hostage crisis in the city of Budyonnovsk in the 
Stavropol Krai republic, northwest of Chechnya. His successful negotiation with the 
Russian Prime Minister for safe passage of the insurgent group to Chechnya created an image 
of ethnic hero.**” 


By 1997, Basayev was promoting a concept to journalists of Chechnya as a moderate 
Islamic state within the Russian Commonwealth of Independent States (CIS), but by 
1999, appeared to be aligning with radical Islamic groups seeking to establish an 
independent Islamic state. Throughout this period, he was involved with senior political 
leaders in Chechnya, but his political intrigues such as personally leading an insurgent 
raid into neighboring Dagestan fractured any accommodation with more moderate 
Chechen leaders. One website notes an alleged interview with Basayev concerning the 
Dagestan raid: “We did not invade Dagestan. Rather, we went there in order to help our 
Muslim brothers in Dagestan ...Dagestan is our nation and it belongs to both the 
Chechens and Dagestanis...” *°* During the Second Chechen War starting in 1999, 
Basayev continued to be a charismatic leader in the fighting, was severely wounded, and 
had part of one leg amputated.*** Yet, he continued to plan and conduct terrorist acts in 
subsequent years as part of a campaign to intimidate and embarrass Russian authorities. 


Table 6-1. Selected Terrorist Incidents in Russian Federation 1999-2004 
Incident Death Location Date 

Moscow Apartments Bombing > 260 | Moscow Sep 1999 
Russian Security Based Attack > 50 | Chechnya Jul 2000 
Moscow Theater Hostage Crisis > 150 | Moscow Oct 2002 
Russian Military Hospital Suicide Bombing | > 50 | North Ossetia Aug 2003 
Russian Metro Train Bombing 40 | Moscow Feb 2004 
Assassination Attempt of Ingush President - | Ingushetia Apr 2004 
Assassination of Chechen President > 5 | Chechnya May 2004 
Raid on Capitol City of Nazran > 90 | Ingushetia Jun 2004 
Russian Airplane Suicide Bombings > 85 _ | Russia Aug 2004 
Moscow Metro Train Bombing 10 | Moscow Aug 2004 
Beslan School Hostage-Mass Murder > 330 | North Ossetia Sep 2004 


332 Tom de Waal, “Shamil Basayev: Chechen warlord,” BBC News-World-Europe, 30 September 1999; 
available from http://news.bbc.co.uk/1/hi/world/europe/460594.stm; internet; accessed 29 January 2007. 


333 «Interview with Field Commander Shamil Basayev,” available from 


http://www. jamiat.org.za/whatsnews/basayvev.html; Internet; accessed 29 January 2007. 


°° T iz Fuller, “Chechnya: Shamil Basayev’s Life of War And Terror,” 10 July 2006; available from 
http://www.rferl.org/featuresarticle/2006/07/290e68ae-54e1-54e1-49c¢3-9fb9-9b4bd72d34a4.html; Internet; 


accessed 29 January 2007. 


6-11 


TRADOC G2 Handbook No. 1.01, Terror Operations: Case Studies in Terrorism 25 July 2007 


Whether directly approved by Basayev or related to a larger regional insurgency, 
sensational acts of terror were increasing in number, spreading anxiety among a larger 
Russian population, and challenging Russian ability to contain and stop these criminal 
activities and murders. Apartment bombings in Moscow caused over 200 deaths, a theater 
hostage crisis resulted in over 150 deaths, a suicide bombing of a military hospital caused 
over 50 deaths, a bombing assassinated the Chechen President, raids in Ingushetia killed 
over 90 people, suicide bombings of two airplanes killed almost 90 people, and a 
bombing of a metro station killed 10 people.** Beslan would be one more tragic event in 
this ongoing series of terrorist acts, and far surpass an already appalling tally of terrorism. 


The leader of the terrorist group at Beslan, nicknamed “Colonel,” was Chechen Ruslan 
Tagirovich Khuchbarov. Wanted by Russian authorities for murder, he had operated in a 
number of Chechen separatist-insurgent groups and was a principle actor in several 
regional terrorist incidents prior to Beslan.”°° Videotape recorded by the terrorists inside 
the school show him as a man of medium build. Wearing a skull cap over a shaved head 
or closely cropped haircut, his face is framed by a 
mustache and large beard flowing from ear to ear. 
The tour that he gives a negotiator presents images 
of other terrorists in various attire of military 
equipment and weapons, and views the tangled 
bodies of adults they had murdered on the first day 
and dumped out of asecond floor window into Figure 6-8. Khuchbarov 
the school yard.*”” 


No one profile fits the terrorists at Beslan. A survey of their terrorist backgrounds present 
a mixed history of criminal activity, inter-family feuds and demands for revenge, fighting 
in the separatist struggle of Chechnya, and in some cases, proclaimed religious 
extremism. A common aspect was having family members who had been killed or 
kidnapped or tortured by Russians in Chechnya or Ingushetia. Hostage interviews after 
the crisis testify to levels of treatment by terrorists from sheer brutality to individual acts 
of benign kindness. Other hostage interviews indicate that some of the terrorists were 
expecting to survive the hostage-taking and were not on a suicidal mission. Suicide, 
seemingly accepted by female terrorists wearing suicide belt-vests, was argued among 
several of the terrorists and appears to have been less than an unconditional commitment 
by all of the terrorists.°° 


335 «Terror’s new depths,” The Economist, 11 September 2004, 372, 23-25; EBSCOHOST 14396044, 
available from http://web.ebscohost.com/ehost/detail? vid=1&hid=115&sid=21b0c25b-a4c0-4a4a...; 
Internet; accessed 20 January 2007. 

°° Henry Plater-Zyberk, “Beslan — Lessons Learned?” Conflict Studies Research Centre, Defence 
Academy of the United Kingdom, November 2004, 2. 

337 «New Video Of Beslan School Terror, CBS News 48 Hours, January 21, 2005, available from 
http://www.cbsnews.com/Sstories/2005/01/20/48hours/main668127.shtml; Internet; accessed 6 February 
2007. This site also links to a video clip recorded by the terrorists inside the school, and includes scenes as 
Khochbarov discusses the hostage situation with Ruslan Aushev, displays dead hostages, and the release of 
several mothers with infants. 

388 Adam Dolnik, “Negotiating the Beslan Hostage Crisis,” (University of Wollongong, Australia: Centre 
for Transnational Crime Prevention (CTCP)), n.d., 31, 36-37, 39. 
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The only Beslan terrorist captured by Russian authorities and surviving after the attack, 
Nur-Pashi Kulayev, stated that the Beslan attack was intended to create an expansion of 
fighting across the Caucasus region, and to incite religious and ethnic hatred based on a 
compulsion for revenge.’ Causing confrontation and strife between Christian and 
Muslim faiths within regional populations was a specific objective. 


In an interview after the Beslan murders, Basayev stated his intention had been to present 
conditions that offered no means for a “bloodless resolution” to the hostage crisis. The 
videotape shows him sitting in front of a banner with Arabic inscriptions. With 
characteristic flair, he promoted his aim for Chechen independence and the requirement 
for complete withdrawal of Russian forces from Chechnya. His comment that he was 
shocked at the carnage of Beslan is quite surprising, when in the same interview, he 
clearly labeled Russian civilians as targets in his war. Basayev stated, “We are planning 
more Beslan-type operations in the future because we are forced to do so.”*”” 


Planning and Preparation 


Terrorist attacks in the months prior to September 2004 displayed a clear increase in 
activity throughout the region of North Ossetia and neighboring Ingushetia and against 
the Russian government at large by Chechen separatists. A female suicide bombing at a 
bus stop in Ossetia in June 2003, a July 2003 double suicide bombing by female terrorists 
at a Moscow rock concert, and a September 2003 suicide truck bomb at a Russian Federal 
building bore the signature of Chechen terrorists and displayed a growing boldness in 
their operations. However, a significant spike in organization and planning occurred for 
the June 2004 attack on the Ingushetia capitol of Nazran and several towns and villages 
along a main highway in the republic. The raids were conducted by an estimated 200 to 
300 attackers. Concerns that Chechen-linked warfighting was coming across neighboring 
borders was accented with concerns that many of the attackers may have been local 
Ingush, as well as Chechen.**! About 100 people were killed in one night of fighting.*“* 
Over 120 people were wounded. Many of the terrorists wore police uniforms during their 
attacks.’ An acting interior minister and his deputy, other government officials, Federal 
Security Service investigators, prosecutors, and local policemen were targeted, and in 
many cases and killed by the terrorists. 


°° Wikipedia, “Beslan School Hostage Crisis-Motives-Islamism.” 

*° Nick Sturdee, “We’re going to do it again, says man behind Beslan bloodbath,” Times Online, February 
3, 2005; available at http://www.timesonline.co.uk/article/0,,3-1468129,00.html; Internet; accessed 29 
January 2007. 

*4! Jean-Christophe Peuch, “Russia: Ingushetia Mourns Its Dead Amid Renewed Concerns For Regional 
Stability,” June 23, 2004; available from http://www.rferl.org/featuiresarticle/2004/6/E69D054A-7AF3- 
459A-83EA...; Internet; accessed 30 January 2007. 

*° «Tracing a tragedy,” The Guardian, September 30, 2004; available from 

http://www. guardian.co.uk/russia/article/0,2763,1315930,00.html; Internet; accessed 19 January 2007. 

43 C.J. Chivers, “Chechen Rebel’s Cause May Die With Him, New York Times, 11 July, 2006, New York 
Times, available from http:/Awww.nytimes.com/2006/07/11/world/europe/11baseyev.html?_r=1&cth&emc...; 
Internet; accessed 11 July 2006. 
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The Nazran, Ingushetia incident provided some important intelligence indicators. This 
raid was the largest raid in the region of this sort in years and occurred in a neighboring 
republic to Chechnya and North Ossetia. What were terrorists planning? Besides 
“ ,.intimidating the Ingush people, intimidating the Ingush leadership, and destabilizing 
the situation in Russia’s south, in particular in the Caucasus region...,” as noted by 
President Putin,*“* what were the multiple raids achieving? At a minimum, the raids 
demonstrated terrorist ability to infiltrate and transit Ingushetia, and conduct attacks. 
Border control appeared to be ineffective. Combined with porous borders and 
allegations of corruption involving bribery at border control points, security measures 
seemed to be inadequate. Security forces and key urban areas appeared unable to 
protect themselves. 


Given the pinpoint targeting of government and law enforcement officials in Nazran, 
terrorists had a dedicated surveillance plan of people and buildings in place; local support 
to separatist terrorists had to be in place within the population too. Surely, other possible 
targets were being considered by terrorists in the region. Reconnaissance must be 
confirming preliminary options and the likelihood of success against specified locations. 


Did any indicators exist for the citizens of Beslan of unusual activities? After the 
September tragedy, citizens of Beslan remember odd occurrences near the Beslan School, 
that in hindsight, appear to be events in active surveillance and reconnaissance of the 
Beslan school and surrounding city blocks. Two Beslan citizens affirmed that one of the 
terrorists identified in the crisis aftermath had been seen in the Beslan marketplace one week 
prior to the attack. Other citizens recall several unknown men sitting on boxes in the school 
courtyard one week before the attack.*“° Another report states that one citizen recalled about 
four vehicles parked near the school with bearded men observing the area.*”” 


During hostage interviews after the Beslan incident, one observant parent noticed that 
lengths of wire used in constructing the bomb connections in the gymnasium were precut 
to size and that the basketball hoops had been part of bomb distribution plan.*”’ Hostages 
stated that terrorists directed floor boards to be removed from certain areas in the school. 
Some stories evolved that weapons or explosives may have been cached by terrorists or 
sympathizers during previous construction work in the school. Flooring had definitely 
been removed in some areas of the school but evidence of pre-positioned materiel was 
inconclusive. A local deputy police chief noted, “They [the terrorists] were so well 


4 Jean-Christophe Peuch, “Russia: Ingushetia Mourns Its Dead Amid Renewed Concerns For Regional Stability.” 
345 Deter Forster, “Beslan: Counter-terrorism Incident Command: Lessons Learned,” Homeland Security 
Affairs, 2 (October 2006); available from http://www.hsaj.org/?fullarticle=2.3.3; Internet; accessed 30 
January 2007. 

346 «dam Dolnik, “Negotiating the Beslan Hostage Crisis,” (University of Wollongong, Australia: Centre 
for Transnational Crime Prevention (CTCP)), n.d., 51. 

347 T awrence Uzzell, “Officials Statements on Beslan: A Study in Obfuscation,” Chechnya Weekly, 5, The 
Jamestown Foundation (September 15, 2004): 4, available from 
http://www.jamestown.org/publications_details.php?volume_id=396&issue_id=3071&...; Internet; 
accessed 20 December 2006. 

348 C_ J. Chivers, “The School,” Esquire, 145 (June 2006), EBSCOHOST, available from 
http://web.ebschohost.com/ehost/detail? vid=11&hid=102&sid=6aa38451-23c8-43e1...; Internet; accessed 
12 January 2007, 5. 
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trained...” He was surprised how quickly they positioned themselves throughout the 
school building and was sure they were very familiar with the interior of the school. “It 
wasn’t the first time they were here.”*“? One hostage recalled seeing a terrorist leader pull 
a map drawing of the school from his pocket as he was questioning her and looking for a 
piece of paper to write a note.” 


Why Beslan? Of the four schools in Beslan, School No. 1 was the largest.°"’ In a 2005 
interview well after the Beslan attack, Shamil Basayev said that large renowned Russian 
cities like Moscow or St Petersburg were considered for attacks but that operational and 
financial limitations caused a more regional target selection.*°* Nonetheless, achieving a 
tactical success in a nearby Russian republic of North Ossetia would still create a crisis 
incident for Russian authorities and spotlight separatist aims for Chechnya. 


The Attack 


In the early morning hours of September 1, the group of terrorists conducted final attack 
preparations in the woods near the border between North Ossetia and Ingushetia. This 
area had also been the training camp for the assault, seizure, and barricade operations 
near and within the school. They departed around 7:00 a.m. in several [reports vary from 
one to three] vehicles. Reports note that the group was observed on an access road by a 
police officer at an isolated outpost. The police officer was held by the terrorists but 
apparently escaped or was released once in Beslan. His attempt to provide timely warning 
to local authorities is questionable. The terrorists drove discretely in Beslan and arrived at 
the school yard shortly after 9:00 a.m. 


The terrorists were well prepared and heavily armed. Some wore camouflage uniforms 
while others wore civilian clothes and athletic attire. Many wore ammunition vests and 
harmesses with various pouches and military equipment such as hand grenades and first 
aid kits. Several men carried assault rifles; some of the terrorists had 40mm grenade 
launchers mounted under the rifle barrels.” Other weapons or individual equipment 
included food and water, rocket propelled grenades (RPG), and protective masks to 
counter debilitating gas or chemicals.“ Sentry dogs were also used as part of terrorist 
warning systems.*”” 


349 Scott Peterson, “Al Qaeda among the Chechens,” Christian Science Monitor, 7 September 2004, 1; 
available from EBCSOHOST, http://web.ebscohost.com/ehost/detail?vid=1&hid=107 &sid=flc91ca8- 
d447...; Internet; accessed 8 January 2007. 

59 Adam Dolnik, “Negotiating the Beslan Hostage Crisis,” 14-15. 

°°! Thid., 52. 

2° Tpid.27: 

353 C. J. Chivers, “The School,” Esquire, 145 (June 2006), EBSCOHOST, available from 
http://web.ebschohost.com/ehost/detail? vid=11&hid=102&sid=6aa38451-23c8-43e1...; Internet; accessed 
12 January 2007, 1, 5. 

aie Sergei Borisov, “A Vision of Hell,” Transitions Online, 6 September 2004, EBSCOHOST; available 
from http://web.ebscohost.com/ehost/detail ?vid=34&hid=102&sid=6aa38451-23c8-43e1...; Internet; 
accessed 12 January 2007. 

%°° Adam Dolnik, “Negotiating the Beslan Hostage Crisis,” 27. 


6-15 


TRADOC G2 Handbook No. 1.01, Terror Operations: Case Studies in Terrorism 


Legend: 


Not to Scale 
» Security 


ced Terrorists 
© Civilians 
} BOMB 


Terrorist 
Truck 


Recovery 
Truck 


Armored 
BTR Vehicle 


Murdered 
Civilians 


2% Explosion 


1. Terrorists 
arrive in truck. 
2. Civilians are 
taken hostage. 
3. Terrorists ring 
hostages with 
many IEDs. 

4. Terrorists set 
barricades and 
defenses. 

5. ca. 20 male 


hostages are 4 


murdered and 
dumped out 

of window. 

6. Terrorist with 
suicide vest-belt 
detonates. 


Auxilary Building 
COffices 


— Je Nc 
Classrooms Classrooms 
Es; 


25 July 2007 


Beslan School 
1-3 September 2004 


CTrainins 


Training Room 


Gymnasium 


School Yard 


School Yard 


Day 1: Seizure and Murder 


ca. 1000+ 
Hostages 


~ 
le ‘Murder 


Figure 6-9. Beslan School 1-3 September Selective Events (Above, Top) 


Figure 6-10. Day 1: Seizure and Murder (Above, Bottom) 


6-16 


TRADOC G2 Handbook No. 1.01, Terror Operations: Case Studies in Terrorism 25 July 2007 


7.Bomb explodes Day 2 and 3: Malice to Mayhem 


in gym; another 
explosion occurs 

8. Terrorists shoot 
emergency services 
men recovering 
remains. 

9. Hostages flee 
gym; terrorists shoot 
at hostages; security 
and cordon forces 
shoot at terrorists. 
10. Terrorists move 
hostages to the 
cafeteria wing. 
11. Terrorists 
continue fighting. 


ca. 1000+ 
Hostages 


12. Security forces 
assault; free some 
hostages who 
move to safety. 

13. Security forces 
fight close-quarters, 
“room-by-room” 

to secure school. 
14. Main fighting 
actions occur near 
cafeteria and 
hallways-rooms; 
many explosions. 
15. Most security 
force casualties 
occur in this wing 
of school; terrorists 
are killed-captured. 


Figure 6-11. Day 2 and 3: Malice to Mayhem (Above, Top) 


Figure 6-12. Day 3: Final Frenzy (Above, Bottom) 


6-17 


TRADOC G2 Handbook No. 1.01, Terror Operations: Case Studies in Terrorism 25 July 2007 


“First September” or the “Day of Knowledge” ceremonies were in progress at Middle 
School No.1 when at least one vehicle drove into the school grounds. About 30 masked 
individuals in camouflage or civilian clothes ran toward the ongoing ceremony and 
started to surround the crowd of parents, teachers, relatives, and school children. Many 
parents had brought their infants to the ceremony because a pre-school nursery was 
closed unexpectedly due to a maintenance problem.*”° Instant anxiety turned to fear as 
several camouflaged men fired their weapons, and shouted phrases such as “Allah 
Akbar!” or “This is a seizure!” Firing rifles into the air and into the ground, the terrorists 
started herding the entire group of civilians toward the school building. 


Some of the school group attempted to run away; some were able to scatter and escape 
from the tightening cordon of armed men. Obviously out-gunned, one parent who was 
carrying a pistol fired at the terrorists in the opening moments of the assault, but was shot 
and killed as terrorists continued to herd men, women, and children into the school. Other 
terrorists quickly offloaded equipment and explosives from the utility truck, and two 
smaller vehicles they had arrived in,??” and started to distribute weapons, ammunition, 
and explosives throughout the school building complex. One report states that five local 
police officers and one terrorist were killed in early exchanges of gunfire.*”* At least two 
terrorists were wounded during the initial seizure of civilians.” Another report says that 
at least two people were killed and eleven wounded in these first hectic minutes.°”” 
Sporadic gunfire continued during the initial hours. 


Terrorist actions were immediate in isolating and neutralizing hostage ability to attempt 
resistance, escape, or contact with anyone outside of the school. Terrorists made a 
thorough search of the school and gathered people who had hidden in first and second 
floor rooms. Most hostages were taken to the gymnasium and told to sit on the floor; 
many had their hands raised behind their head. One hostage remembers that men who 
attempted to resist were killed immediately; other wounded hostages were led out of the 
gym and killed in the hallway.**! 


Adult males were separated in most instances from the women and children. Some men 
were used to break windows. Although many hostages thought this breakage was due to 
the stifling condition in the gym, others suspected that terrorists did this as a precaution 
against the use of debilitating gas as used by Russian security forces during the Moscow 
theater hostage crisis. A group of about twenty male hostages was used to block probable 


356 T awrence Uzzell, “Officials Statements on Beslan: A Study in Obfuscation,” Chechnya Weekly, 5, The 


Jamestown Foundation (September 15, 2004): 3. 

°°7 «Beslan Hostage Crisis Ends in Disaster,” The Current Digest of the Post-Soviet Press 56 no. 36 (October 6, 
2004): 6. This report cites three vehicles: a GAZ-66, a UAZ, and a VAZ-2110. 

°°8 Wikipedia, “Beslan school hostage crisis-Course of the crisis-Day 1,” available from 
http://en.wikipedia.org/wiki/Beslan_school_hostgae_crisis; Internet; accessed 10 January 2007. 

59 Adam Dolnik, “Negotiating the Beslan Hostage Crisis,” 14. 

°° “Chechen Terrorists Seize School in North Ossetia,” The Current Digest of the Post-Soviet Press 56 no. 
35 (September 29, 2004): 1. 

°°! “Chechen Terrorists Seize School in North Ossetia,” The Current Digest of the Post-Soviet Press 56 no. 
35 (September 29, 2004): 5. 
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entrances to the school with fumiture and other items. Once these tasks were 
accomplished, the group was taken to a second floor room and murdered with gunfire. 


All mobile or cellular telephones were confiscated from the hostages. Terrorists 
threatened to kill anyone found with a phone as well as several people around any person 
found with a phone.* Other threats stressed mass punishment for individual 
disobedience. “If any of you resist us, we will kill children and leave the one who resists 
alive!”°’ The terrorists demanded that only Russian be spoken by the hostages. After 
allowing one adult to speak to the hostages in the gymnasium in an attempt to quiet 
everyone, he was shot and killed in front of everybody. He had spoken in Ossetian. His 
body was dragged into a hallway leaving a large red trail smeared on the floor. 


Figure 6-13. Hostage Crisis and Murder at Beslan 


Meanwhile, several terrorists were methodically setting improvised bombs throughout the 
school building. Backpacks and other equipment brought into the school held the 
material for a large number of improvised bombs; some were small plastic bottle looking 
devices; some rectangular devices were the size of a small briefcase.°™“ In the 
gymnasium, bombs were connected together along the floor in a “daisy-chain” type 
arrangement. Other explosives were attached by wires to the basketball hoops in the 
gymnasium and hung suspended over the hostages. A terrorist was positioned in open 
view standing on an alleged pressure plate that would explode the bombs if his body 


3° Wikipedia, “Beslan school hostage crisis-Course of the crisis-Day 1.” 

383 ©. J. Chivers, “The School,” Esquire, 145 (June 2006), EBSCOHOST, available from 
http://web.ebschohost.com/ehost/detail?vid=118chid=102&sid=6aa38451-23c8-43el1...; Internet; accessed 
12 January 2007, 2. 
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pressure was released off of the small platform. Unknown to Russian authorities at the 
time, over 120 improvised explosives were being positioned throughout the school.*® 


Measures to fortify and barricade the school were immediate with well rehearsed plans. 
Teams had specific tasks to accomplish. Some terrorists focused on preparing defenses 
for an assault from local police and militia; some started assembling bombs and tripwires; 
a small number of terrorist-guards contained the hostages. Snipers were positioned at key 
locations in the school building complex.** Other terrorists occupied classrooms, 
library, administrative areas, and cafeteria. 


Thought had been given to exploiting the media. The terrorists recorded their actions in 
the gymnasium and hallways of the school on videotape and provided it for media 
distribution. Sensationalism was important. Graphic scenes on the terrorist videotape 
showed a bomb being assembled on the gym floor, next to the blood path that had been 
caused when a hostage’s dead body was dragged away. At least several hundred people 
were packed into the gym; another panning of the gym shows a young boy sitting with 
his hands behind his head, fear in his eyes, and a terrorist standing nearby holding an 
assault rifle. The terrorists also maintained contact with sources outside of the hostage 
site via their own mobile telephones. The terrorists were aware of much of the 
international media coverage of their incident.°”” 


Local police and other security forces gradually cordoned the school area about 10:30 
a.m. Establishing a perimeter to isolate the school was disorganized. Law enforcement 
leaders lacked effective control of an exclusion zone from terrorist gunfire.’ Only about 
one hundred meters separated a porous perimeter from the school area. One photographer 
was able to position in a nearby building with a security force team and maintained a 
clear view of the school complex.** Civilians were allowed to meander on the streets and 
among houses and apartments, and in some cases walked within easy shouting distance to 
the school. Some terrorists were yelling taunts from the school windows. Sporadic gunfire 
directed at the school caused an ultimatum by the terrorists. Hostages were placed in window 
sills, in some cases, to stop the firing from the surrounding streets and buildings. 


Initial attempts to contact the terrorists by telephone and initiate a foundation for 
negotiations were not received well by the terrorists. Terrorists wanted direct contact with 
very senior Russian officials. About an hour later, terrorists had one female hostage 
deliver a hand-written note to the cordon. Terrorists demanded to see President 
Dzhosokhov from North Ossetia, President Ziazikov of Ingushetia, Aslambek 


36 Adam Dolnik, “Negotiating the Beslan Hostage Crisis,” 12. 

3 Thid., 6. 

°°” Henry Plater-Zyberk, “Beslan — Lessons Learned?” Conflict Studies Research Centre, Defence 
Academy of the United Kingdom, November 2004, 2. 

38 C, J. Chivers, “The School,” Esquire, 145 (June 2006), EBSCOHOST, available from 
http://web.ebschohost.com/ehost/detail? vid=11&hid=102&sid=6aa38451-23c8-43e1...; Internet; accessed 
12 January 2007, 13. 
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Aslakhanov as a senior advisor to Russian President Putin, and a Dr. Leonid Roshal who 
had assisted in some negotiations during the 2002 Moscow theater terrorist hostage- 
taking incident. They also stated several threats: for every terrorist killed, 50 hostages would 
be killed; for every terrorist wounded, 20 hostages would be killed; and if five terrorists were 
killed, they would “...blow everything up.” The terrorists also threatened to shoot ten 
hostages if the lights [electrical power] were turned off or the communication links were 
disconnected. A telephone number was posted in the note. *” 


Telephone contact with the terrorists was not progressing toward any accommodation. 
Both terrorists and Russian officials wondered what would be the next significant move 
in negotiation. Gun fire had stopped from the cordon. The school was clearly well 
defended by the terrorists. The two female terrorists rigged as a suicide bombers were 
near a hallway. Another terrorist stood nearby with hostages. About 3:00 p.m., an 
explosion ripped apart one of the female suicide bombers. Her belt-vest bomb had detonated 
without any obvious warming. The other female terrorist wearing a suicide belt-vest died 
from the blast too, and blast effects and shrapnel peppered another terrorist guard and 
some hostages. At least two hostages died from the explosion. 


After caring for one of the wounded terrorists, a terrorist leader directed the wounded 
hostages be brought upstairs in order to receive medical attention. He lied. The hostages 
were led into a room and killed in a burst of rifle fire.°’’ Some hostages say that the 
female terrorists disagreed with targeting a school and children and had argued among 
the terrorists.” Yet, reports that the female terrorists were killed purposely by the 
terrorist leader with a command detonation of the belt-vest bomb seems improbable 
based on other terrorists who were killed or severely wounded in the bomb blast. 


In the late afternoon, the terrorists sent a female hostage with another note to the cordon. 
The note provided a corrected phone number to the note delivered earlier in the day by 
the same hostage. Ruslan Aushev was requested to come to Beslan. He was a former 
President of Ingushetia and well respected in the Caucasus region. 


Lights remained on in the school all night. Dr. Roshal attempted to negotiate with the 
terrorists via telephone for several hours during the evening, but to no success. From the 
police perimeter outside of the school yard, single gunshots were heard periodically 
throughout the night from within the school. Described as warning shots by the terrorists, 
the occasional crack of a gunshot startled civilians maintaining a vigil along the area 
cordon. The terrorists had organized for duty shifts and had a rest plan among the group 
members.””° Periodically, the terrorists listened to news from commercial radio broadcasts.°”* 
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Around midnight, Roshal was talking again with the terrorists via telephone in an attempt 
to negotiate some allowance for water and food for the hostages, or an exchange of 
children hostages for adults. These talks ended abruptly after midnight when terrorists 
stopped talking on the phone.*” 


Day Two 


Daylight did not indicate recognition of any workable options for negotiation. Russian 
announcements on the previous day that only 120 hostages had been seized infuriated the 
terrorists. Even a revision by Russian authorities to over 300 hostages was grossly less 
than the over 1000 hostages that the terrorists, local citizens, and Russian authorities 
knew were in the school. Attempts at negotiation stalled. 


By noon, the terrorists declared more restrictions based on the Russian media 
announcements that were downplaying the significance of the hostage-taking and the 
immediate crisis that was underway. Terrorists denied food and water to the hostages, 
and severely restricted any physical movements in the rooms or previous allowances to 
use bathroom facilities.°’° Hostages had not been given food since the start of the 
hostage crisis. Now, hostages were getting desperate in their dehydration. Some hostages 
even resorted to drinking urine. 


Conditions remained tense. During the mid-afternoon, at least two rocket propelled 
grenades (RPG) were fired by terrorists at the surrounding perimeter; one RPG set a car 
on fire. Some reports that state that the terrorists were on drugs such as heroin appears 
overstated. However, some terrorists probably did have stimulants to stave off fatigue. 


Then, some hostages recall that the terrorists had heard something from their leader that 
visibly pleased them. Some form of negotiation was about to take place. At mid- 
afternoon, one man was allowed entry to the school by the terrorists. Ruslan Aushev, a 
former President of Ingushetia, surveyed the status of hostages, saw the corpses that had 
been dumped into the school yard on the previous day, and discussed possible options 
with the terrorist leader. 


A positive sign of progress was in motion. Aushev and the terrorists had arranged an 
accommodation on selective release of some hostages. Several women with nursing 
infants would be allowed to exit the school. About 5:00 p.m., a van was allowed into the 


374 C. J. Chivers, “The School,” Esquire, 145 (June 2006), EBSCOHOST, available from 
http://web.ebschohost.com/ehost/detail? vid=11&hid=102&sid=6aa38451-23c8-43e1...; Internet; accessed 
12 January 2007, 11. 

375 «Chechen Terrorists Seize School in North Ossetia,” The Current Digest of the Post-Soviet Press 56 no. 
35 (September 29, 2004): 4. 

36 C. J. Chivers, “The School,” Esquire, 145 (June 2006), EBSCOHOST, available from 
http://web.ebschohost.com/ehost/detail? vid=11&hid=102&sid=6aa38451-23c8-43e1...; Internet; accessed 
12 January 2007,14. 


6-22 


TRADOC G2 Handbook No. 1.01, Terror Operations: Case Studies in Terrorism 25 July 2007 


restricted area next to the school and returned with additional hostages.°”’ 26 people were 


released by the terrorists. Approval to remove bodies from the school yard would wait 
until the following day. 


The terrorists handed Ruslan Aushev a hand-written note’”® dated August 30 supposedly 


from Shamil Baseyev. Demands still focused on the removal of Russian forces from 
Chechnya. English translations of the note may differ slightly; however, the basic text of 
the note follows: 


Vladimir Putin, you were not the one to start the war, but you could. 
_be the one.to end it, that is if you find the courage and resolve to act 
like de Gaulle. We are offering you peace on a mutually beneficial — 

basis in line with the principle “independence for:security.” We can 

guarantee that if you withdraw the [Russian] troops and recognize 

Chechen independence, then: we will not strike any political, military 

or economic deals with anyone against Russia; we will not have any 

foreign military bases even temporary ones; we will not support or 
finance groups fighting the Russian Federation; we will join the 

Commonwealth of Independent States; we. will stay in the ruble zone; 
we could sign the Collective Security Treaty, although we would 
_ prefer the status of a neutral state; we can guarantee that all of 
~ Russia’s Muslims will refrain from armed methods of struggle against 

the Russian Federation, at least for 10-15 years, on condition that 

freedom of religion is respected... The Chechen nation is involved in 
the national liberation struggle for its Freedom and Independence 

and for its preservation. It is not fighting to humiliate Russia or 

destroy it. As a free nation, we are interested in a strong ppg HET: =e 
“We are eee hee and the choice is yours. 


Figure 6-14. Beslan Terrorist Note of Demands to President Putin 
Day Three 


The third day of the hostage crisis was tense in the streets and buildings around the 
school. What might occur next increased the general anxiety. What were the authorities 
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coordinating? Would there be another release of hostages? There had already been so 
much killing — corpses were visible in a jumbled pile below a second floor window at the 
school. What would the Russian security forces do? 


Time and events seemed in Limbo — a clock on the wall ticked away the seconds, minute 
by minute, as both the Russian authorities and the terrorists were peering to see what 
action would occur next. 


“The school will not be stormed.” North Ossetian President Alexsandr Dzasokov 
announced to relatives and friends of hostages around 11:00 a.m. He told the crowd near 
the school that his greatest hope was that the terrorists would get tired, demand buses, 
and hostages would be released. He said, “We are willing to give the terrorists free 
passage to any destination, to any border...”°” 


Demands had been stated to the Russian authorities several times since the beginning of 
the hostage-taking. Primary demands by the terrorists for Russia to remove Russian 
forces from Chechnya and for President Putin to resign had gone unanswered. Notes had 
been delivered by a hostage to the Russian authorities on two separate occasions.” 


The terrorists were getting very agitated and anxious by the start of the third day. 
Telephone conversations were leading nowhere. Russian offers to exchange adults for 
children, or coordinating for safe passage of the terrorists appeared to have failed. The 
terrorists knew that a Russian response to hostage-taking was usually an armed response. 
The terrorists also knew that in past terrorist confrontations, Russians had typically 
conducted an armed assault on about the third day of an incident.**' 


Conditions inside the school were past critical for many of the hostages. They had been 
without food since the beginning of the crisis, and without water since the previous day 
when the terrorists denied water as an additional restriction. Physically, hostages were 
very weak. Any sleep was a strange notion of drowsy fits coupled with sudden alerts of 
what was happening to them. Emotionally, they were desperate. 


Shortly before 1:00 p.m., terrorists in the gymnasium moved some of the improvised 
bombs along the floor closer to one of the walls.*®* Other bombs remained as originally 
set among and above the group of hostages.*”” 
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Moments to Mayhem 


An agreement was arranged to allow emergency services to remove corpses from the 
school yard that had been pushed out of second floor windows on the first day. 
Meanwhile, most of the children were very dehydrated, physically exhausted, and 
propped listless around the gymnasium. Adult hostages faired no better. The terrorists 
acted nervous and agitated. Shouts led to them beating some people. Terrorists argued 
with each other. 


Six rescue service workers dressed in red and blue striped coveralls slowly approached 
the school building with a van to remove the bodies.** Time seemed to stop. A near 
visible tension saturated the air. Terrorist snipers were prepared for a ruse and assault by 
Russian forces; other terrorists were manning their assigned points in the building 
complex and checking the readiness of their weapons. The terrorists in the gymnasium 
looked at the chain of bombs in the gymnasium. 


Suddenly, the gymnasium erupted in a large explosion. Windows shattered and window 
frames were blown from the walls. Bodies hurled against walls and each other. Many 
hostages near the detonation were killed outright from blast and shrapnel; many other 
hostages were wounded. Seconds later, a second explosion occurred in the gymnasium. 
Reports differ on whether the initial explosion was caused by security forces or the 
terrorists.*°° Everything went into slow motion. For many, physical numbness and 
emotional shock quickly gave way to natural adrenalin and the need to escape. 


Two emergencies services members were shot and killed almost immediately by the 
terrorists as gunfire burst from the school shortly after the explosion.*° In the 
gymnasium, an instinct for survival compelled many of the hostages to act. Hostages 
were stumbling through a hole in the wall created by the explosion, while others were 
jumping from the high window sills and tumbling to the ground. Other hostages were 
stunned or moaning from their wounds; some hostages were perfectly still. 


A panicked scramble by hostages spread throughout the school yard as they attempted to 
find safety beyond the mixed cordon of security forces, police, and civilians. Terrorists 
were shooting at fleeing hostages; people along the cordon were shooting at terrorists. 
Soldiers, policemen, and armed civilians from the cordon assisted hostages as best they 
could to quickly seek cover and safety. Security forces entered the school at breaches 
they created in walls with explosives charges. 
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Injured hostages were placed in ambulances or any available transportation. Civilian cars 
were used to evacuate when casualties quickly overwhelmed existing ambulance 
capability. Vehicles blocked streets and cars had to be pushed off roadways to allow for 
evacuation to nearby medical treatment points and hospitals. Fire trucks, emergency vehicles, 
and civilian vehicles were intermixed in a frenzy. 


Conditions were just as hectic inside the school as bullets smacked interior walls with 
many hostages still trapped with the terrorists. Gunfire from inside and outside the school 
shattered temporary moments of pause. Some hostages were able to be carried or led 
from the school as fighting continued in other areas of the building complex. Decisions 
by the terrorists inside the school building caused another serious development. 


The terrorists were puzzled that no major assault had occurred in conjunction with the 
initial explosions. About 30 minutes after the initial explosions, movements around the 
school and increasing gunfire confirmed that security forces were pressing closer to the 
school building for an assault. An explosion near the gymnasium roof started a fire that 
eventually caused a portion of gym roof to collapse that killed many hostages died. 


Figure 6-15. Hostages Escape as the Fight Continues 


Prior to the roof collapse, one of the terrorist leaders gathered several other terrorists in 
the main hallway and directed hostages in the gym to follow them to the school cafeteria 
on the first floor. A large number of hostages were already on the cafeteria floor when 
they arrived. Other terrorists were firing their weapons from cafeteria windows. Metal 
bars across the windows may have been one reason that the terrorists chose to use this as 
their defensive position. No one could easily get in or out of the room. Women were 
ordered by the terrorists to place themselves and children in the window spaces to act as 
human shields for the terrorists.*” Mothers waved cloths and kerchiefs from between the 
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window bars and screamed for the firing to stop. Gunfire continued from outside of the 
school as terrorists fired weapons from the cafeteria windows. 


The magnitude of gunfire, rockets, grenades, and explosions were taking a toll on the 
terrorists as Russian security forces fought their way into and through the gymnasium 
area about 2:00 p.m. Individual vignettes illustrate the personal connections in a small 
community. One mother, reeling from shock in the gymnasium after the bomb 
explosions, found her daughter wounded and unconscious. Dragging her along the floor, 
soldiers started to jump into the gym through window openings. She recognized one of 
the soldiers as a neighbor and shouted to him. At first, he did not realize who she was but 
then recognized her and helped to carry the daughter to safety.*”* 


Life and death fighting continued in close-quarters, room-by-room fights down the school 
hallways. In the cafeteria, security forces had entered through a breach at one of the 
windows. Just as rescue seemed to be imminent for one mother, terrorists and security 
forces came face-to-face inside the cafeteria. Neither the security force soldier nor the 
terrorist could miss their target as gunfire erupted at point-blank range. As the terrorist 
recoiled from bullets hitting him, he tossed a hand grenade. The explosion shook the 
room. Women and children were dead or wounded; at least one security forces soldier 
and one terrorist lay dead on the floor.**” 


Tanks were also used to fire their main guns into the school as Russian forces fought to 
kill or capture the terrorists, and rescue the hostages. Two tanks had been staged one 
block from the school. A tank was directed to move forward near the fence bordering the 
school.*”” Security forces designated areas still occupied by terrorists and ordered a tank 
to fire several main gun (125 millimeter) rounds into the school.”’' Russian forces 
breached school walls with small explosive charges to create entry points for some of 
their attacks and also for removing hostages from areas of the school. Russian helicopters 
could be heard overhead by the hostages.*** Explosions and gunfire echoed in classrooms 
and down the hallways of each floor. 


The roof near the gymnasium was smoldering or on fire. The two initial explosions had 
damaged a portion of ceiling. Whether the explosions or use of Shmel flamethrowers by 
Russian forces to destroy a sniper location caused subsequent fires is contentious. 
Nonetheless, this flamethrower weapon is more accurately described as an incendiary 
rocket launcher. In addition to its incendiary purpose, each rocket has blast effects of a 
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122mm artillery round.*”’ After the fighting, expended launchers were found by citizens 
on the rooftops of nearby buildings.*”* Eventually, portions of the school roof collapsed. 


Fighting continued in the school between pockets of terrorists and teams of Russian 
security forces. One mother hiding her child in a classroom, saw a Russian soldier 
looking at her from a doorway across a hall. As he darted into the hall, bullets slammed 
into him and he fell into the room next to the woman.” He died. Other soldiers jumped 
into the room, paused to bandage wounds, and continued to attack down the hallway. 


Figure 6-16. The Fighting Concludes and Aftermath 


Some of the terrorists attempted to break out of the school cordon and evade Russian 
forces and local citizens. One report states that thirteen terrorists, including two women, 
did succeed in leaving the school and occupied a nearby building. This indicates at least 
four women in the group of terrorists at Beslan. The building was destroyed by tanks and 
Shmel rockets by mid-evening.””° Terrorists at this site died in the fighting. 
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Gradually, Russian forces secured more areas of the school and pressed individual 
terrorists or small terrorist groupings into final acts of isolated fighting. By 3:00 p.m., 
three terrorists had barricaded themselves and several hostages in a school basement. All 
of these terrorists and hostages were killed in the final fighting.*”” 


A senior Federal Security Service official stated that the terrorists probably had a 
“support team” outside of the school in surrounding buildings as part of the terrorist’s 
tactical plan. He noted this type of reserve was common and “...when some of the 
terrorists managed to break out of the school, they had fire support from somewhere 
outside.” Another Russian special unit member said that once some of the terrorists had 
fought their way out of the school, they started to disperse in different directions. °° 


Some terrorists attempted to escape from the carnage by blending into the local populace. 
One terrorist was beaten to death by the outraged fathers of hostages when he was 
identified trying to seek medical attention as a civilian. Another terrorist was lynched by 
a mob once he was cornered and apprehended.” Some terrorists probably escaped. 
Reports indicate that at least two alleged terrorists claimed to be medical providers. 
Another episode recounted a just-released hostage finding her mother outside of the 
school. Still in shock, they saw a man sitting in a parked car and asked to be taken to their 
home. He was wearing a police uniform but did not have any shoulder straps. Just then, 
another man dressed in black and unshaven got into the car, as the driver started the 
vehicle. They ignored the home address stated by the woman, drove in the opposite 
direction, and angrily said, “I do not know the place.” Both women jumped from the car 
and felt certain that these men were participants to the terrorist attack of the school.*”° 


Accounts differ on when the school was actually secured and when all of the known 
terrorists were captured or killed. By early evening, almost all fighting ceased; yet, reports of 
some gunfire and final struggles continued into the wee hours of the next morning.””' 


The Russian Federal Security Service initially reported that 20 terrorists had been killed 
and that some were not of regional ethnic groups. Some reports listed Arabs and one man 
described as black among the terrorists. Reports included three terrorists being 
detained.*° Later, these reports would change with more accurate information. Some 
public criticism stated that Russian authorities were attempting to create a tenuous 
link of the attack with al Qaeda associated international terrorism. Other reports 
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ranged terrorist ethnicity to include Chechen, Ingush, Kazakhs, Slavs, and North 
Ossetian men and women. 


At least 32 terrorists conducted the Beslan hostage-taking and mass murder incident. One 
terrorist was captured, was tried and convicted, and is serving a life sentence in a Russian 
prison for his crimes. Evidence suggests that additional terrorists were involved in the 
operation beyond the killed or captured terrorists, and may have included a total group of 
between 50 to 70 terrorists.*” 


Civil Law Enforcement and First Responders 


Local police and regional law enforcement agencies were unprepared for such a dramatic 
and violent action by terrorists. The school was guarded by one unarmed police officer 
without an immediate means of communication. Local traffic police, who may have 
normally been in the area, had been tasked to provide security at a different event.““* An 
improved intelligence and analysis capability by security forces may have discerned a 
higher risk at Beslan, and taken additional police security precautions around Beslan 
schools. Information about possible school attacks and separatists allegedly penetrating 
into the Beslan area was not acted upon, even though indications were evident.*” 


Figure 6-17. Recovery Efforts After the Fight 


Once the terrorists had seized hostages and barricaded themselves inside the school, 
securing the site with an effective cordon might have precluded armed civilians or militia 
from further complicating containment of the school site. Some civilians were allowed to 
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join the cordon with their own weapons. Many civilians were allowed to roam the 
neighboring streets, and nearby houses and apartments remained occupied by residents 
during the crisis. The general safety of local civilians near the school block area was in 
jeopardy throughout the incident. 


The security concept of an inner cordon to contain the terrorists and outer cordon to block 
civilians from interfering with operations was poorly conducted.*°° The mix of Federal 
forces and army elements, special counter- 
terrorism forces, Ossetian republic organizations, 
local police, untrained volunteers, undisciplined 
local civilians with weapons, and a general 
populace observing from streets and buildings 
was a disaster waiting to happen. 


The urban setting made conditions all the more 
difficult. The cordon perimeter was only about 
two hundred meters or less from the school. The 
surrounding streets were lined with trees and line 
of sight positions had to be close to the school. The 
residential-commercial area ranged from small single Figure 6-18. Local Police Take Cover 
story structures to multi-story apartment buildings. 


Groups of armed civilians added to moments of no control after the gymnasium 
explosion. The panic of hostages attempting to escape, and the start of random shooting 
by both civilians shooting into the school and terrorists shooting at fleeing hostages and 
anyone else in the schoolyard was pandemonium. One report states that terrorists also 
threw hand grenades at the hostages.*”” 


Questions of how the terrorists arrived so easily in Beslan and how police response 
appeared so sluggish in the initial minutes of terror fermented several stories about police 
corruption and ineptitude. One hostage states that one of the terrorists boasted of buying 
their safe way past any potential security checkpoints. Another report notes one of the 
reasons police did not start arriving at the school until well over an hour after the terrorist 
seizure of the school was an inability to unlock a container and distribute weapons at the 
local police station.“”* 


Local firefighting departments were unprepared to respond to a hostage crisis. City 
firefighting teams were unable to reduce fire damage when confronted with gunfire and 
explosions.*”’ Rightful concern existed by firefighters on whether or not the school scene 
was secure from remnants of the terrorist group. Yet, whatever fire department staging 
and preparation occurred during the previous two days of crisis resulted in dismal 
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performance. When firefighters were allowed to enter the school area on the third day, 
the first fire truck seen at the school after the final assault arrived with an empty water 
tank.“ Another report states that fire trucks 
arriving at the school almost immediately used all 
of their available water source supply.*"* 


The large number of dead bodies overwhelmed the 
ad hoc means for mortuary affairs. As bodies were 
gradually extracted from the school building 
debris, a slow and grim process started in body 
identification. Temporary measures were often 
rows of bodies on the ground. Eventually, bodies 
were covered with available sheets or material. 


Figure 6-19.Firefighters at Beslan 


Identifying remains, cause of death, and release of remains to the next of kin was an 
arduous process. Many remains had been badly burned; officials and family members 
were unable to identify many of the corpses and would have to wait for detailed 
forensics. Even this later process was problematic for some as the cost for such analysis 
was placed on family members to verify remains that may be in question. Some remains 
required refrigeration until preliminary examinations could be completed. Burials started 
almost immediately for many families. The local cemetery was too small for such a large 
number of graves and had to expand to an adjacent plot of land.*’* 


Incident Command and Coordination 


Clear command and control, that is, the coordinated leadership effort toward resolving 
the crisis was not conducted effectively by the Russian authorities on site at Beslan. 
Transfer of critical information; incorporating local expertise and knowledge of the area, 
facilities, and buildings; and integrated operations were not apparent between the local 
authorities, Republic representatives, military forces, and Federal security forces. Not having 
one chain of command on the scene at Beslan was problematic and dysfunctional.*”” 
Operational contingency plans to counter a mass hostage situation such as Beslan did not 
appear to exist. 


The first command center was established and managed directly by the President of 
North Ossetia/Alania, Alexandr Dzasokhov, in a nearby building. Hours later, a separate 
command center was activated by senior officials who had arrived from the Russian 
Federal Security Service (FSB). Actually, two FSB staffs were formed during the crisis. 
A military general officer led a Federal Operational Staff, and a separate staff was 
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attached to three deputy Federal Security Service chiefs. These three entities appeared to 
work independently and were, in some instances, counter-productive to each other’s 
efforts.*'* Communications and information sharing appeared stovepiped, rather than 
inter-operational in cooperation. 


In the months following the Beslan incident, Federal legislation in Russia assigned the 
main responsibility for counter-terrorism to the Federal Security Service (FSB). The Chief of 
the FSB or one of his subordinate leaders has the decision authority on conducting counter- 
terrorism activities and is responsible for their operational implementation.*!” 


Other post-Beslan elements of improved organizational structure and effectiveness 
include standing operational staffs to deal with terrorism; consolidation of authority for 
certain law enforcement agencies, security services, and army forces in combating 
terrorism; expansion of manpower in divisions of the Ministry of Internal Affairs and 
units of the Ministry of Defense; and information and tactical intelligence sharing.*’° Yet, 
many areas of organizational effectiveness and reform remain to be proven. 


Negotiations 


Professional negotiators were not apparent in the unraveling crisis of hostages with a 
scene already confounded by murder of civilians during the initial hours in the school 
yard and school building. Some civilians had been shot and killed during the initial 
assault into the school. One adult male was murdered in front of people clustered in the 
gymnasium. Bodies of several dead adult males were dumped out of a second floor 
window by terrorists on the first day of the hostage crisis. 


Negotiations, or the appearance of negotiations, were under the constant gaze of parents, 
friends, and relatives near the school. Signals of hope were tenuous. The eventual release 
of some women and children, was offset by periodic gunshots from within the building. 
Terrorists shot at people and vehicles along the perimeter established around the school 
by security forces, local police, and militia. 


Previous major incidents involving hostages appeared to show a lack of Russian 
government patience in negotiating with terrorists. Security forces or military forces action 
seemed to be the favored tactical response rather than some level of accommodation.*"” 


Time was a premium and a response would be necessary. Was consideration given to 
possible terrorist objectives other than a complete suicide mission?*'® What opportunities 


*'4 Otto Luchterhandt, “Russia Adopts New Counter-Terrorism Law - Analysis,” Russian Analytical Digest 
2 (20 June 2006): 2. 

“!9 Tbid., 2. 

“16 Andrei Soldatov and Irina Borogan, “Terrorism prevention in Russia: one year after Beslan,” Report of 
the Agetura.Ru Studies and Research Centre (ASRC), September 2005, available from 
http://studies.agentura.ru/english/listing/terrorismprvemtion/...; Internet; 20 December 2006. 

"7 Deter Forster, “Beslan: Counter-terrorism Incident Command: Lessons Learned,” Homeland Security 
Affairs, 2 (October 2006); available from http://www.hsaj.org/?fullarticle=2.3.3; Internet; accessed 30 
January 2007, 3. 
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existed for negotiations to possibly gain an initial concession? Did the ability exist for 
establishing some level of rapport or confidence building in the early phase of the hostage 
crisis? Did the murders by terrorists allow for negotiation and some action less than a 
security forces assault? 


The Media Morass 


Governmental public affairs and media relations officials did not provide accurate 
information in public announcements.*'? Some official statements were intentionally 
misleading. Initial statements by officials on the low number of hostages were criticized 
immediately by local citizens. Criticism erupted as rage in some cases as family members 
and friends felt helpless in a spiraling crisis of terrorist demands and public affairs 
disinformation. Local citizens knew generally how many children and adults had been 
attending the school celebration and claimed that officials were purposely 
underestimating the magnitude of the hostage crisis. 


The terrorists were angered as commercial radio reports of the hostage situation stated 
hostage numbers in the low hundreds, rather than the over 1000 people the terrorists had 
within the school building. The result was a further terrorizing of hostages inside the 
school and restriction of hostage food and water. 


Details of the Beslan crisis were purposely muted by Russian officials. Russian television 
was noticeably absent from much of the international media coverage. Even though 
Rossiya TV had a live feed of Beslan images periodically to the British Broadcasting 
Company (BBC) and Cable News Network (CNN), Russian viewers often had to wait for 
updates only from news programs. When the hostage crisis deteriorated to the final chaos 
of explosions, shooting, and mass murder, Russia’s main television channels continued 
with the usual broadcasting programs. Other channels like the BBC, CNN, and Euronews 
started transmitting live pictures from the schoolyard area. 


Nonetheless, some photographers and correspondents were able to enter the immediate 
area surrounding the school and witness the series of events and catastrophic ending. 
Photographers captured numerous scenes of tragedy and quickly distributed pictures to an 
international public ready to consume. One example of this grim fascination occurred just 
after the explosions in the gymnasium. One small girl was blown out of the gymnasium 
through a window space and unto the schoolyard. Wearing only underwear and shoes, 
she rose to her feet slowly but apparently unhurt. Dazed, she climbed back into the 
school through a window rather than turning to the safety of those people along the 
perimeter. Pathos.*”° 


Media restrictions existed at the local Beslan hospitals. Film crews that appeared at the 
hospital were searched and forced to surrender all of their film footage.**' Medical 


418 . 
Ibid. 
“!9 Nabi Abdullaev, “Beslan Revisited,” Homeland Defense Journal 4 (January 2005): 11. 
#0 Chris Jenks, “A New Death of Childhood,” Childhood, 12, 2005, 6. 
“I «Beslan Hostage Crisis Ends in Disaster,” The Current Digest of the Post-Soviet Press 56 (October 2004): 3. 
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workers had their mobile phones confiscated and were not allowed to leave the hospitals 
after completing their shifts.*” 


Use of tanks and incendiary rockets by security forces was a questionable level of force 
when hundreds of civilians were known to be in the school, even after the panic of a 
breakout attempt by some hostages following the explosion in the gymnasium. The 
decision to fire a tank’s large caliber main gun several times into the school and shoot 
flame rockets [“flamethrower” is the term used in most reports] from nearby buildings 
might have been minimized with a degree of security forces forethought. In perspective, 
the terrorists had been very heavily armed. A tally of weapons and munitions collected 
from within the school after the terrorists were killed or captured included: over 35 
assault rifles, three machine guns, as well as grenade launchers, rocket launchers, hand 
grenades, pistols, ammunition, TNT, and other weapons and explosives. Over 120 
improvised explosives had to be cleared from the school.*” 


Victims and Medical Treatment 


Medical evacuation vehicles and medical 
facilities were unprepared to accept and 
treat the large number of injured hostages 
and members of the security forces.*~ 
Attempts at triage were quickly 
overwhelmed. Ambulances were largely 
unavailable as wounded hostages escaped 
or were rescued from the school. Lack of 
cleared evacuation routes complicated 
timely medical evacuations. Private 
automobiles had to be pushed out of road 
ways in some situations to allow other 
private vehicles, commandeered to carry Figure 6-20. Ad Hoc Casualty Evacuation 
wounded and injured hostages, a route toward 

area hospitals or temporary treatment points.*”” 


However, some medical contingency preparation was underway during the crisis. Over 
1000 hospital beds in Beslan and the nearby city of Vladikavkaz were being prepared for 
the possibility of mass casualties.“°° Well over 400 civilians were hospitalized with 
over half of the patients being children. A majority of the injuries included gunshot 
wounds, shrapnel wounds, burns, and other physical trauma. One month after the 


“°° Wikipedia, “Beslan school hostage crisis-Course of the crisis-Domestic repercussions-Allegations of 
censure.” 

“°3 Henry Plater-Zyberk, “Beslan — Lessons Learned?” Conflict Studies Research Centre, Defence 
Academy of the United Kingdom, November 2004, 6. 

“4 Nabi Abdullaev, “Beslan Revisited,” Homeland Defense Journal 4 (January 2005): 11. 

#5 Nabi Abdullaev, “Beslan, Russia...Terror! in the Schoolhouse,” Homeland Defense Journal 3 
(September 2004): 33. 

“6 adam Dolnik, “Negotiating the Beslan Hostage Crisis,” 63. 
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attack, 240 people were still being treated in regional hospitals with about half that 
number being children.*”” 


Meanwhile, the hospitals and temporary morgues were crowded with parents, relatives, 
and friends looking for family members and friends. Of the known dead, only about 180 
had been identified two days after the incident while about 160 people were missing and 
unaccounted for by families.*”° 


Throughout the crisis, Russian authorities 
provided a large team of experts to Beslan for 
psychological counseling and treatment of adults 


Table 6-2. Beslan Casualties 


C : and children. During the initial days of crisis, the 
asualties Number : : ; 
Tere relatives of hostages were the primary patient 
aT group. After the third day climax of fighting, 
Civilians > 330 ae: ; : 

; ; priority of treatment shifted to patients as they 
Security-Mil Forces 40 were received in Beslan medical facilities. 
Local Police 7 Follow-up interviews and counseling continued 
Emer Responders > 2 as patients expressed feelings such as fear or 
Terrorists 31 guilt. Morgues and funerals received on-site 
Subtotal > 378 psychiatrist coverage too.’ This medical 

response appears to be one of the few success 
Wounded stories of decisive, coordinated, and proper 
Civilians > 700 action by Russian authorities. Yet, some reports 
Security-Mil Forces > 50 questioned the effectiveness of psychological 
Local Police 2 treatment plans.’ The issues of posttraumatic stress 
Emer Responders ? disorder (PTSD) will exist for a considerable time 
Terrorists 2 based on Russian and other medical studies.**' 
Subtotal > 750 
Physical casualties were a grim count of dead 
Casualty TOTAL: > 1128 and injured. Of the over 370 deaths at Beslan 


during the three day period, 331 deaths were 
civilians with 317 of them having been hostages. Children deaths totaled 186 within this 
casualty number. Other deaths included five law enforcement officers, four emergency 


“7 Wikipedia, “Beslan school hostage crisis-Course of the crisis-Casualties.” 

“8 «Beslan Hostage Crisis Ends in Disaster,” The Current Digest of the Post-Soviet Press 56 (October 2004): 3. 
“9 Tom Parfitt, “How Beslan’s children are learning to cope,” World Report, 364 (December 4, 2004), 
avaibale from www.the lancer.com; Internet; accessed 20 January 2007. 

430 Elizabeth Jensen, “A ‘Shattering’ Documentary About Beslan,” Television Week, 25 (June 29, 2006), 
EBSCOHOST, available from http://web.ebscohost.com/ehost/detail? vid=11&hid=102&sid=6aa38451- 
23c8-4331-9b52-...; Internet; accessed 12 January 2007. 

431 Sara Scrimin, Giovanni Axia, Fabia Capello, Ughetta Moscardino, Alan Steinberg, and Robert Pynoos, 
“Posttraumatic reactions among injured children and their caregivers 3 months after the terrorist attack in 
Beslan, Psychiatry Research 141 no 3 (March 2006), 333-336, EBSCOHOST, available from 
http://web.ebscohost.com/ehost/detail?vid=12&hid=102&sid=6aa38451-23c8-43e1-9b52...; Internet; 
accessed 12 January 2007. 
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responders, and at least ten security forces soldiers.**? Over 700 civilians were wounded, 


and over 50 security forces and military members were wounded.**? The number of 
terrorists noted as present at Beslan in most accounts is 32 terrorists. Russian official 
reports state that 31 terrorists were killed and one terrorist was captured. Many reports 
still contest that many terrorists evaded and escaped from the Beslan area. 


Even the number of hostages seized by the terrorists differs depending on the source and 
how people were counted. One early report from a local Beslan administrator said that 
1,347 people were hostages, while another official said that 1,156 hostages were seized 
by terrorists.” 


Postscript 


NOTE: In July 2006, Shamil Baseyev was killed in Ingushetia by Russian security forces. 
Reports state that a truck loaded with munitions exploded, killing the terrorist leader and 
several of his followers. Opinions differ if the explosion was accidental*” or was the 
culmination of a successful counter-terrorism operation by Russian forces.**° 
Notwithstanding, Baseyev’s death removed one of the more notorious figures from the 
regional strife of separatism, religious extremism, and terrorism. 


432 C. J. Chivers, “The School,” Esquire, 145 (June 2006), EBSCOHOST, available from 
http://web.ebschohost.com/ehost/detail? vid=11&hid=102&sid=6aa38451-23c8-43e1...; Internet; accessed 
12 January 2007,26 ; and, Wikipedia, “Beslan school hostage crisis-Course of the crisis-Casualties.” 

“83 “The Voice of Beslan’ intend to apply to European Court of Human Rights,” 24 June 2006; available 
from http://eng.kavkaz.memo.ru/newstext/engnews/id/1080600.html; Internet; accessed 20 December 2006 
“Beslan school hostage crisis,” available from http://www.martinfrost.ws/htmlfiles/beslan_siege.html; 
Internet; accessed 1 February 2007. 

4 «Tracing a Tragedy,” The Guardian, 30 September 2004; available from 

http://www. guardian.co.uk/russia/article/0,2763,1315930,00.html; Internet; accessed 19 January 2007. 

“35 Peter Finn, “Blast Kills Leader of Separatists in Chechnya,” Washington Post, 11 July, 2006, available 
from http://www. washingtonpost.com/wp-dyn/content/article/2006/07/10/AR2006071000307.html; Internt; 
accessed 11 July 2006. 

“8 «Political Developments in Chechnya,” CountryWatch — Country Review: Russia, 9, available from 
http://www.countrywatch.com/cw_topic.aspx?’vCOUNTRY=142&TOPIC=A...; Internet; accessed 12 
January 2007. 
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Case Discussion Questions 
Intelligence and Threat Warning? 


e What activities preceding the September 2004 attack might have indicated the intent 
of the terrorists to attack a major city population and its infrastructure? 


e How did specific extremist activities in the region around North Ossetia indicate a 
security risk to Russian or Federation interests? 


e Why did the terrorists select the Beslan middle school celebration as a target? 
Security Measures in Effect? 


e What centralized command and control procedures existed among civil government- 
military organizations for emergency response to a catastrophic incident? 


e Were adequate security measures in place at the school? What role do police have in 
force protection activities? 


e What perimeter separation distance would have been more effective in assisting crowd 
control and protection? 


e What commodities or concessions may have been part of initial negotiation attempts with 
the terrorists? What authority should a negotiator have had in dealing with the terrorists? 


e What is the role of the law abiding citizen? Why did military forces and law enforcement 
authorities allow civilians to be part of the security perimeter with weapons? 


e How did the Russian security forces apply techniques of target containment and 
collateral damage? What limitations on use of lethal force existed during the crisis? 


e How did the security forces and civilian police control the local civilian population 
during the assault into the school, the breakout attempt by several terrorists, and the 
immediate medical recovery operations? 


Terrorist Tactics, Techniques, and Procedures? 


e What precedents in domestic terrorism in the Russian Federation could have focused 
government awareness and counter actions? 


e How did the terrorists transport and assemble the improvised explosive devices? 
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What type of rehearsals did the teams conduct for the attack? What indicators of 
surveillance of the target site may have existed? What actions indicated that the 
terrorists had detailed knowledge of the building interior? 


How could terrorists have increased mass casualty effects as even more devastating? 
What facts may have indicated that the hostage crisis was not a guaranteed terrorist 
suicide mission? When were hostages murdered inside the school? Were there 


murders by terrorists on day 2 or day 3 before the explosion in the gymnasium? 


How did the terrorists attempt to communicate with Russian authorities? How did 
Russian authorities facilitate or damage negotiation trust? 


How did the terrorist cell structure itself, communicate, and operate during the phases 
of final planning, rehearsals, and execution of the attacks? How did terrorists attempt 


to escape and evade from the school building? 


What implications exist for the deterring or dissuading domestic terrorism by citizens 
or naturalized residents of Western nations? 
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Table 6-3. 


Selected Observations from Beslan Hostage Crisis and Mass Murder 


Observation Topics for Seminar Study and Discussion 
Incident e Effectiveness of crisis command and control among Federal, 
Command and Republic, and local authorities. 

Control (C2) 


e Effectiveness of Federal senior leaders at the crisis center in 
representing a national presence. 


e Effectiveness of intelligence sharing among echelons of Federal, 
Republic, and local authorities. 


e Effectiveness of information cooperation among echelons of 
Federal, Republic, and local authorities. 


e Rules of engagement (ROE) for use of and type of lethal force by 
security and military forces. 


Negotiation e Conduct of negotiation team to introduce and develop 
accommodation or compromise. 


e Role of senior Federal leaders in facilitating and responding to 
specific terrorist demands. 


Civil Law e Physical security and rapid response conduct by local police 
Enforcement during increased level of threat. 


e Medical evacuation route control and clearance and quick egress. 
e Cordon control around the incident site. 


e Crime scene protection for forensic investigation. 


Medical and e Employment of psychiatric response team during the crisis and 
Hospitalization after the crisis ended. 


e Conduct of hospitalization contingency plans in preparation for 
mass casualties. 
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e Medical vehicle staging for evacuation of mass casualties. 


Mortuary Affairs | e Conduct of contingency plans for mortuary affairs during the 
crisis and after the crisis ended. 


e Conduct of identifying and storing remains after the crisis. 


e Conduct of individual and mass interments. 


Firefighting e Conduct of staging firefighting vehicles and equipment during the 
crisis. 


e Conduct of firefighting operations once allowed access to the 
crisis site. 


Media-Public e Accuracy and truthfulness of information provided by Federal 
Relations crisis center authorities to media and local citizens. 


e Restrictions on specified correspondents to preclude access to the 
crisis site. 


e Effectiveness of Federal misinformation operations to public and 
corresponding antagonism of terrorists. 


e Effectiveness of Federal counterterrorism tactics and operations. 


Training e Conduct of regular crisis response exercises at Federal level of 
Readiness government. 


e Conduct of regular crisis response exercises at Republic level of 
government. 


e Conduct of regular crisis response exercises at local level of 
government. 


e Coordination among civil and military authorities in combating 
terrorism. 
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Planning for the Future 


Who will be the first responder in a similar crisis within the United States? Local 
response is the first response capability. In a hostage situation, local first responders will 
require key information immediately to assess aspects such as number of hostages, 
number of casualties, number of criminals, building and room configurations, electrical 
power sources, heating sources, and access and egress routes to the site. The murder- 
suicide trauma of Columbine High School in Littleton, Colorado (1999) illustrated issues 
such as law enforcement and emergency services being unsure of several critical pieces 
of practical information-intelligence in the incident site, instances of near fratricide 
among responding law enforcement organizations, other initial command and control 
issues as multiple agencies reported to the 
crisis. Timely public information needs to 
be distributed accurately to the public.*”” 


First Response is Local 


Local law enforcement organizations 
must collaborate regularly with State and 
Federal organizations in information 
sharing and intelligence gathering of 
potential terrorist threats in a community. 
Correspondingly, trained and ready law 
enforcement teams, focused on terrorism, 
hostage taking, or similar crisis situations, 
must be readily available for authorities to 
employ. This awareness includes much 
more than a response capability with 
Special Weapons and Tactics (SWAT) teams. 


Figure 6-21. Domestic Terror Response 


Intelligence preparation and knowledge of the local environment is critical to law 
enforcement success. For example, the Los Angeles Police Department and its 
Counterterrorism and Criminal Intelligence Bureau analyzed observations from Beslan in 
2004 and considered contingencies if a similar terrorist attack occurred in their city. The 
police used intelligence indicators of criminal or potentially criminal activity to 
concentrate surveillance and covert operations on a Chechen connection. As the 
investigation evolved, an international car theft ring appeared to have links to 
international terrorism. A Chechen businessman in the US affiliated with an apparent 
charity organization caused special concern when he displayed photographs of himself 
with Chechen terrorist Shamil Basayev. Eventually, warrants and arrests stopped the car 


‘87 «New Era for Threat and Incident Management,” Government Technology, April 2005, available from 
http://www. govtech.net/govcenter/solcenter/index.php?id=98095; Internet; accessed 20 December 2006. 
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theft ring in early 2006 with no publicity of terrorism.*”® Yet, detecting and disrupting 


criminal support networks and money laundering capable of provisioning terrorism can 
be part of local, regional, Federal, and international law enforcement actions in 
the Global War on Terrorism. 


Figure 6-22. First Responders to Crisis: Police-Emergency Services-FBI 


Cultural Awareness is Critical 


The culture in which a crisis occurs will have significant influence on the official reaction 
to a hostage crisis and potential murder scenario. Demonstrating the ability for physical 
force, as well as applying a larger range of psychological or specialized methods, can be 
a common expectation in a society that wants immediate results and success. Such 
actions can be conducted in a conventional manner,*”’ or used as an unconventional or 


“88 Robert Block, “An L.A. Police Bust Shows New Tactics for Fighting Terror,” Wall Street Journal, 29 
December 2006; available from http://online.wsj.com/article/SB116736247579862262.html?mod=googlmews_wsj; 
Internet; accessed 30 December 2006. 

48° The Posse Comitatus Act, 18 U.S.C. 1385, prohibits the use of the Army or the Air Force for law 
enforcement purposes, except as otherwise authorized by the Constitution or statute. This prohibition 
applies to Navy and Marine Corps personnel as a matter of DOD policy. The primary prohibition of the 
Posse Comitatus Act is against direct involvement by active duty military personnel (to include Reservists 
on active duty and National Guard personnel in Federal service) in traditional law enforcement activities. 
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asymmetric advantage.” The pressure from a public for authorities “to be seen doing 
something” must be complemented with legitimate means to gain the initiative in a crisis, 
attempt to reduce tensions, and resolve crisis with less than lethal force when possible. 
Not all cultures or nations may accept the same way of containing and solving a crisis. 
Yet, conditions may deteriorate where direct and forceful action must be employed to 
safeguard lives and property from wanton threats. 


Training is Readiness 


A 2005 conference organized with support of the North Atlantic Treaty Organization 
(NATO)-Russia Council provided a forum for national preparedness and response experts 
to discuss lessons learned from recent terrorist attacks. Although statements were not 
necessarily official national policy or positions, the Russian team shared experiences and 
insights and identified major lessons and needs from terrorist attacks in Russia:“*! 


e Improve effective legislative and executive coordination. 

e Synchronize existing national and international legislation. 

e Invest training resources for emergency medical personnel, hostage negotiation 
teams, and special assault forces. 

e Address non-military counter-terrorism strategies such as terrorist financing, 
narcotics trafficking, and better international intelligence sharing. 

e Improve airline security. 

e Enhance effective public information policy and minimize the psychological effects 
of terror on the general public. 


The United States team at the (NATO)-Russia Council conference provided these major 
lessons and needs from the 1993 and 2001 World Trade Center terrorist bombings: 


e Provide efficient information and intelligence sharing among military, law 
enforcement and emergency response personnel. 

e Improve capabilities for military, law enforcement, and emergency response 
personnel to work in a dangerous environment. 

e Standardize operations throughout all levels of government [local, State, Federal], 
especially communications between law enforcement agencies and emergency 
medical centers. 

e Develop a coherent, credible public information policy. 

e Conduct frequent emergency response exercises. 


““° Mike Bullock, “Unconventional Thinking,” Armed Force Journal; available from 
http://www.armedforcesjournal.com/2007/01/2362906; Internet; accessed 8 January 2007. 

“41 «Chairman’s Report: Lessons learned from recent terrorist attacks: Building national capabilities and 
institutions,” NATO-Russia Council, Ljubljana, Slovenia, 27 June-1 July 2005; available from 
http://www.nato.int/docu/conf/2005/050727/index.html; Internet; accessed 20 December 2006. The US 
Mission to NATO and George C. Marshal Centre with the support of the Slovenian Foreign Ministry 
organized this professional forum under NATO-Russia Council auspices. 
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Reduce Vulnerability to Terrorism 


The capstone U.S. Federal document for all-hazards domestic incident management is the 
National Response Plan*** dated December 2004 and its Notice of Change to the 
National Response Plan**’ that provides updates as of May 2006. This provides guidance 
for local, State, Federal, and tribal government coordination and approach to manmade 
and natural hazards, as well as terrorist incidents. Principles of the NRP can apply to 
planning and preparing for terrorism wherever terrorists may strike. 


The National Response Plan, exercised regularly, is part of a collective effort to prevent 
terrorist attacks...reduce America’s vulnerability to terrorism,‘ major disasters, and 
other emergencies; and minimize the damage and recovery from attacks, major disasters, 
and other emergencies as they occur. A publication series by the Department of 
Homeland Security (DHS) can assist to focus training and exercising. Combined with 
other aspects of antiterrorism and counterterrorism preparedness, the ability to plan, train, 
exercise, and improve readiness against terrorism is critical to this Federal, State, and 
local mandate. The Homeland Security Exercise and Evaluation Program (HSEEP)*” 
reference manuals provide a common framework for assessing terrorism prevention, 
response, and recovery capabilities. The HSEEP is a threat- and performance- based 
exercise program. 


Given domestic crisis incidents such as Beslan (2004) in Russia or Columbine (1999) in 
the USA, readiness must: 


“,..ensure that all response personnel and organizations — including the 
law enforcement, military, emergency response, healthcare, public 
works, and environmental communities — are properly equipped, trained, 
and exercised to respond to all terrorist threats and attacks...” 


National Strategy for Homeland Security 


“ Department of Homeland Security, National Response Plan, December 2004; Washington, D.C.: 
Department of Homeland Security. 

443 Department of Homeland Security, Notice of Change to the National Response Plan, 25 May 2004; 
Washington, D.C.: Department of Homeland Security. 

“““ Department of Homeland Security, National Response Plan, December 2004, 1. 

“*’ Department of Homeland Security, Office for Domestic Preparedness, Homeland Security Exercise and 
Evaluation Program, Volume I: Overview and Doctrine, revised May 2004. 
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Table 6-4. 


Chronology of Beslan: Hostage Crisis and Mass Murder 


Chronology Selective Event Sequence Source 
(NOTE: Time sequences may be approximate.) 


NOTE: Multiple reports are considered in stating approximate times for this series of 
events. (Ca. circa) 


Legend. Several references used in the “source” right-hand column are coded with 
letters for simplicity. References are: 


ACPC. John B. Dunlop, “Beslan: Russia’s 9/11,” The American Committee for Peace in Chechnya and 
The Jamestown Foundation, available from www.peaceinthecaucasus.org/reports/beslan.pdf; internet; 
accessed 15 February 2007. 


CDPSP. “Beslan Hostage Crisis Ends in Disaster,” The Current Digest of the Post-Soviet Press 56 no. 36 
(October 6, 2004). 


DS. [Report by Uwe Buse, Ullrich Fichtner, Mario Kaiser, Uwe Klausmann, Walter Mayr, and Christian Neef: 
“Putin’s Ground Zero] EUP20050118000220 Hamburg Der Spiegel (Internet Version- WWW) in German 27 
Dec 04 pp 65-101. “Russia: Survivors of Sep 2004 Beslan Hostage Drama Describe Course of Events,” 
available from https://;www.opensource.gov/portal/server.pt/gateway/PTARGS 0 0 246 203 0 43/http...; 
Internet; accessed 14 November 2006. 


E. C. J. Chivers, “The School,” Esquire, 145 (June 2006), EBSCOHOST, available from 
http://web.ebschohost.com/ehost/detail? vid=11&hid=102&sid=6aa38451-23c8-43e1...; Internet; accessed 
12 January 2007. 


HDJ. Nabi Abdullaev, “Beslan, Russia...Terror! in the Schoolhouse,” Homeland Defense Journal 3 
(September 2004). 


MT. “61 Hours of Horror,” The Moscow Times.com, September 6, 2004; available from 
http://www.themooscowtimes.com7/Sstories/2004/09/06/016-full.html; Internet; accessed 8 February 2007. 


W. Wikipedia, “Timeline of the Beslan school hostage crisis,” available from 
http://en.wikipedia.org/wiki/Timeline_of_the_Beslan_school_hostage_crisis; Internet; accessed 17 
January 2007. [Online source quality used best when other multiple sources can confirm information. ] 


Chronology Selective Event Sequence Source 
Summer 2004 
Summer 04 Terrorists conduct reconnaissance surveillance of potential 
targets in the regional area. Beslan school is selected as a 
target on a day with maximum civilians at the school. 
Summer 04 Terrorists alleged to have hidden explosives and materiel 


under flooring inside of the Beslan school during a facility 
renovation-construction project. 
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07:00 (+) 


09:00 


09:00-09:20 


09:20 


09:30 


09:45 (+) 


10:15 


10:15 (+) 


10:15-10:25 


10:30 


10:30-11:10 


11:00 


11:00 ca. 


11:15 


September 1, 2004 
A truck approaches an isolated security outpost in 
Ingushetia and near the North Ossetia border. A lone 
policeman is made a hostage by armed terrorists as the 
terrorists continue on their journey to Beslan in a three 
vehicle group. 


Beslan School No. 1 starts the opening ceremonies for the 
school year. 


Terrorists seize Beslan School No. 1: Several people are 
killed as civilian, police, and terrorist exchange gunfire; 


Hostages are held in school. 


Terrorists are searching school building rooms and 
collecting hostages. 


North Ossetia’s Republican Ministry for Emergencies 
announces school seizure. 


Terrorists start emplacing improvised bombs throughout 
the school and barricading building access points. 


Russian Federal Security Service (FSB) anti-terrorist group 
is alerted to deploy from Moscow to Khankala, Chechnya. 


Four motorized rifle (infantry) companies start to deploy to 
Beslan from the North Ossetia capitol of Vladikavkaz. 


News agencies report that two schools have been seized 
but revise report 30 minutes later as one school seized. 


Local police and regional military forces start to form a 
cordon around the Beslan School area. 


Government officials announce that between 200 to 400 
hostages have been seized by 17 to 20 terrorists. 


Terrorists refuse to negotiate with local policemen and fire 
shots over their heads. 


Hostages are forced to stand in front of school windows as 
human shields for the terrorists inside the school. 


Terrorists place children in front of windows as human 
shields; sporadic shooting from outside school stops. 
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11:30 


11:30 


11:30 


11:30-11:50 
(11:35?) 


12:15 


12:30 


12:30 


13:00 


13:25 


13:50 


14:00 


Russian army units begin cordoning off the school area. 
Local police command and control of the initial cordon 
appears confused. 


Republic interior ministry closes educational facilities in 
Beslan; all flights to North Ossetia capitol Vladikavkaz are 
canceled; public buildings receive additional security; 
border is closed between North Ossetia and Ingushetia . 


North Ossetia President Alexander Dzasokhov arrives at 
hostage scene. 


Terrorists send note to cordon with a hostage with 
demands and threaten to kill hostages if electricity or 
communications are severed; demand to see three 
individuals: Dzasokhov, Zyazikov, and Roshal. 


Terrorists shoot at people attempting to recover three 
bodies in school yard. 


15 civilians escape to safety of cordon after hiding ina 
boiler room during the initial terrorist attack. 


Terrorists release some hostages with videotape of school 
interior and hostages, and a note with demands to Federal 
Government authorities. 


Russian President Putin arrives in Moscow and directs 
Interior Ministry and FSB leaders to Beslan. 


Terrorists refuse offer to exchange hostage children for 
adults; terrorists demand withdrawal of Russian forces 
from Chechnya. 


North Ossetia Interior Ministry revises increased count of 
hostages to 600 with over 130 being children. 


Senior leaders on the scene do not appear decisive in 
actions or in command of the situation. Leaders include 
Regional Intelligence Chief Andreyev, Parliamentary 
Speaker Mamsurov, Duma Deputies Rogosin and 
Markelov, and Deputy Prosecutor General Fridinsky. 
North Ossetia President Dzasokhov is present also. 
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14:00 


14:30 


15:00 


15:00 + 


15:30 


15:40 
12:30 (?) 
16:00 


16:30 


17:00 + 


18:00 ca. 


Terrorists refuse to negotiate with regional leaders, and 
demand to talk with Dzasokhov (North Ossetia), Zyazikov 
(Ingushetia), and Roshal (civilian doctor). 


Russian Interior Minister and Federal Security Services 
(FSB) Director arrive in Beslan. FSB Chief Patrushev does 
not meet with crisis staff and is not observed as present in 
operations for next two days. 


Bombs strapped to [two] female terrorists detonate by 
mistake or are detonated by the terrorist leader. One 
woman terrorist with bomb belt detonates suddenly 
without warning; other women terrorist with bomb belt is 
killed by other woman’s bomb belt explosion. At least two 
hostages die and six hostages are wounded in the 
explosion. 


Adult male hostages wounded by the women’s bomb belt 
explosion are brought to a second story room and 
murdered by terrorists. 


Terrorists threaten mass killing of hostages for every 
terrorist killed or wounded; terrorists drop note from 
school building window and demand Russian forces 
withdraw from Chechnya. 


Around 15 children are [released] from inside the school. 


Seven male hostages are taken to second floor of school 
and murdered by terrorists with gunshots. 


Terrorists give female hostage note with demands and 
corrected phone number digits and addition of former 
President Ruslan Aushev to requested list of people. 


Male hostages are used to dump previously murdered male 
hostages out of a second story school window. 


Male hostages are ordered to take two dead bodies and six 
seriously wounded hostages from the first floor hallway to 
a first floor classroom. (These wounded hostages are 
murdered during the night with gunshots.) 
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18:25 


19:00 


20:00 


20:15 


20:30 


20:50 


21:10 


23:00 (?) 


23:00 
23:59 Ca. 


00:15 


UNK 


03:00 


Russia calls for emergency session of UN Security Council 


North Ossetia official announces that authorities have 
‘established contact’ with the terrorists. 


Terrorists tell a correspondent they belong to a militant 
group called Riyadh al-Salihin and are loyal to the 
Chechen leader Shamil Basayev. 


Dr. Leonid Roshal arrives in Beslan to negotiate with 
terrorists. (Roshal had negotiated at the Moscow theater 
terrorist-hostage crisis.) 


Terrorists refuse offer of water and medicine to hostages. 


UN Secretary General demands immediate release of 
Beslan hostages. 


US newspaper publishes report that terrorists claim to 
represent terrorist group [Riyadh al-Salihin] associated 
with Shamil Basayev. 


Dr. Leonid Roshal makes contact with terrorists via 
telephone and attempts to coordinate medicine, food and 
drinking water for hostages. 


Dr. Leonid Roshal offers safe departure to Ingushetia and 
Chechnya and to replace hostage children with adults. 


September 2, 2004 


Chechen leader (mufti) denounces hostage-taking and 
offers help on behalf of Chechnya’s Muslims. 


Gutseriev, former Vice Chairman of the State Duma, 
discusses options with terrorists via telephone. Terrorists 
request that Ruslan Aushev come to Beslan and that 
written conditions-demands would be provided to Aushev. 


Terrorists stop several hour telephone discussion with 


Roshal abruptly by turning off telephone; terrorists refuse 
offer of water, food, and medicine and any exchanges. 
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03:00 


04:45 


07:00 


08:55 


09:00 


Morning 


10:00 


10:00 


10:30 


11:00 


14:00 
15:30 (?) 


14:00 


14:10 


15:00-15:30 


Terrorists demand that Aslanbek Aslakhanov, Putin’s 
advisor on Chechnya, enter negotiations. 


UN Security Council condemns Beslan school seizure and 
demands unconditional release of hostages. 


North Ossetia authorities announce that seven people have 
died in hostage crisis and 354 people are hostages. 


Federal Security Services announce terrorists are 
Chechens, Ingush, Russians, and Ossetians. 


Male hostages are ordered to remove eight hostage bodies 

from a first floor hallway and move the bodies to a second 
floor classroom. Six wounded hostages had been murdered 
during the night with gunshots.) 


Terrorists deny food and water to hostages. 
Roshal resumes negotiations to terrorists with offer of safe 
passage from North Ossetia and large sum of money, but 


offer is rejected by terrorists. 


Ruslan Aushev arrives in Beslan to negotiate face-to-face 
with terrorists. 


Chechen and Ingush elders offer to help in negotiations 
and denounce hostage-taking. 


Putin addresses Russia for first time since beginning of 
crisis stating main task is lives and health of hostages. 


Former Ingush President Ruslan Aushev enters school and 
negotiates with terrorists for release of 26 hostages 


comprised of mothers and nursing babies. 


President Putin makes public announcement and states all 
actions will be taken to save the lives of the hostages. 


Command Center at Beslan states that use of force will not 
be used to free hostages. 


Terrorists fire two rocket propelled grenades (RPG) at 
security forces and set one car on fire. 
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15:20 


15:30-16:30 


14:00 (?) 


16:45 


Evening 


18:30 


20:00 


20:00 ca. 


20:15 


21:00 


22:15 


01:00 (?) 


02:00 


07:30 


Tanks and armored personnel carriers are directed to 
Beslan and placed under control of Federal security forces. 


Former Ingush President Ruslan Aushev enters the school 
and negotiates release of 26 hostages: mothers and infants 


Terrorists send note to government forces with demand 
that Russian troops withdraw from Chechnya and allow an 
independent Chechnya. 


Special Advisor Aslakhanov to President Putin discusses 
coming from Moscow to Beslan and agrees to continue 
negotiation talks the following day. 


Russian officials revise initial estimate on number of 
hostages from around 350 to more than 1000 hostages. 


Terrorists shuffle 35 to 40 adult men and women from the 
gymnasium to an adjoining athletic room. The hostages 
believe they are about to be murdered. After a ten hour 
wait, hostages are moved back into the main gymnasium. 


Roshal holds news conference, talks briefly of discussions 
with terrorists, and criticizes lack of action by International 
Committee of the Red Cross. 


Negotiations continue into the night with intention of 
allowing delivery of food and water to hostages. 


Chechen rebel envoy tells an interviewer that former 
Chechen President Maskhadov is willing to assist in 
negotiation with hostage-takers. 


September 3, 2004 


Terrorists fire rocket propelled grenade at government 
forces causing wounds to one police officer. 


Throughout the evening and into the wee hours of night, 
negotiators attempt to develop options with the terrorists to 


deliver food, water, and medicine to the school. 


Discussion resumes with terrorists after having been 
suspended abruptly the previous night by terrorists. 
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Morning 


11:00 


12:45 


13:00-13:05 


13:05 ca. 


13:05 (+) 


13:05 (+) 


13:20 ca. 


13:20 ca. 


13:10-13:30 


13:20<14:00 


13:30 


13:30-14:00 


13:30 ca. 


The crisis staff orders that the security cordon will be 
enlarged that will cause an additional two city block 
separation from the school. 


North Ossetia President Aleksandr Dzasokhov states to 
families of hostages that school will not be stormed and 
“we” are willing to provide free passage to terrorists... 
He notes there may be over 900 hostages. 


Terrorists agree to allow Emergency Ministry members 
remove corpses of 20 male adults from school courtyard. 


Four emergency ministry or medical individuals approach 
school building with two trucks to recover corpses. 


A large explosion occurs in the gymnasium. 


A second large explosion occurs in the gym within several 
seconds of the first explosion. 


Hostages start jumping from windows of gymnasium and 
run toward cordon; police, armed volunteers, and civilians 
run toward courtyard to assist fleeing hostages; terrorists 
start shooting at fleeing hostages. Some flee through 
courtyard; some flee over wall at rear of school. 


A third explosion occurs at the gymnasium. 


Some hostages are forced into school basement by a small 
group of terrorists. 


Russian security forces start to a slow approach to the 
school building from the courtyard area. 


Terrorists are consolidating at school cafeteria and using 
collected hostages as human shields. 


Portion of gymnasium roof burns and collapses 
Russian tanks and armored vehicles reposition in vicinity of 
school; tank fires main gun into school. 


Security forces and civilians force their way into the weight 
lifting and gymnastic room area from the outer wall of the 
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13:40 


13:45 


13:55 (+) 


14:00 


14:05 


14:00 (+) 


14:25 


14:25 


14:25 


14:30 (?) 


14:30 


14:40 


building, and release several hostages. No terrorists are in 
the immediate vicinity. 


Russian commandos “Alfa” join the schoolyard fighting 


Report of some terrorists fleeing building; Russian forces 
pursue terrorists; armed civilians join the pursuit. 


Security forces fight to secure first floor areas and continue 
room-by-room assault against terrorists; terrorists firing at 
hostages from roof as hostages attempt to flee. 


Some hostages are being brought to safety as Russian forces 
continue to search school building and fight terrorists. 
Terrorists continue to shoot into gymnasium and at people 
evacuating wounded former hostages. 


Russian forces report that most of the school building is 
under Russian forces control. 


After explosion, less terrorists are in cafeteria. Some 
hostages run to a classroom area at the end of a hallway 
opposite the cafeteria. Hostages breach a window to escape 
but several civilians are wounded or killed by shooting from 
outside of the school. 


Security forces control most of school building; some 
terrorists barricade in basement [with hostages]. 


Some terrorists flee to neighboring buildings near school; 
some terrorists attempt to evade in civilian clothes. 


Security forces create a hole in the gym wall with a small 
demolition; fighting inside the building continues; hostages 
continue to be evacuated from site. 


Medical personnel enter gym and triage. 


Terrorists concentrate in school cafeteria and use women 
and children as human shields. 


Russian forces use explosives to make entry-egress points 
in school walls. 
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14:45 


15:00 


15:00 


15:10 


15:15 


15:25 


15:40 


15:55 


16:10 


16:15 


17:00 


17:30 


17:35 


Some terrorists have changed into blue jeans and T-shirts 
with intention of blending with escaping hostages and 
evading capture. (With most civilians originally dressed in 
fine clothes for the school ceremony, the blue jeans identify 
terrorists in the fleeing groups of civilians.) 


Russian “Alpha” commandos approach schoolyard in three 
armored personnel carriers. 


Russian tank enters apartment area [and shoots several main 
gun rounds] near school yard. 


Heavy fighting continues around the school and on 
neighboring streets; some terrorists are reported to be 


surrounded in a nearby apartment building. 


More than 100 bodies of hostages are found in school with 
most casualties occurring from explosion in gymnasium. 


Group of about 13 terrorists that fled school occupy a house 
south of school and are destroyed by Russian forces. 


A group of 13 terrorists is surrounded in south Beslan. 


Three terrorists barricade themselves in school basement 
with some hostages as human shields. 


Angry mob attempts to lynch an alleged terrorist; actions 
are televised. 


Firefighters, medical, and emergency services members 
enter the school and remove remaining injured hostages. 


Russian control of the school now includes the gymnasium, 
main corridor, assembly hall [on second floor], cafeteria [on 


first floor], and classrooms in the front part of school. 


An alleged female terrorist is arrested next to the command 
center near the school. 


One terrorist posing as a wounded hostage is identified and 
lynched by local citizens. 
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18:45 (?) 


19:00 


19:35 


20:15 


20:15 
20:50 


21:00 


21:00 


21:20 


21:20 


21:50 


22:10 


22:30 (?) 


22:40 


Three terrorists, including the terrorist leader, and hostages 
remain barricaded in basement; All terrorists and hostages 
eventually die in attempt to free hostages. 


Gunfire is still heard from inside the school. 


Officials announce that 20 terrorists have been killed, and 
describe some of the terrorists as Arab and one black man. 


Large explosion occurs at school. Intermittent gunfire 
continues at the school and in neighboring areas of Beslan. 


Crisis center reports that all terrorists have been suppressed. 
Officials announce 63 hostage deaths including 12 children. 


One report describes an attack on a building near the school 
thought to be a refuge for fleeing terrorists; the building 
was “destroyed by tanks and flamethrowers.” 


Casualty count notes 646 people in hospitals with 227 of 
the casualties as children. A report states 652 hostages are 
in hospitals, including 228 children. Senior Russian Federal 
official states more than 150 hostages have been killed. 


Federal Security Forces Chief announces that fighting 
continues inside the school. Gunfire is coming from the 
large workroom in the rear of the school wing. Explosions 
occur also. 


Confirmed deaths exceed 200 as bodies continue to be 
identified. 


Sporadic fighting continues even though some reports state 
that all terrorists have been killed. 


One report states that three terrorists have been captured. 
Federal Security Force teams overwhelm a small group of 
terrorists who had barricaded themselves in a school 


basement. 


Army official announces that all of the terrorists have been 
killed or captured. 


6-57 


25 July 2007 


W, 3 
MT, 4 


DS, 46 


MT, 4 


MT, 4 


W, 3 
MT, 5 


W, 6 


W, 3 
MT,5 


DS, 47 


MT, 5 


TRADOC G2 Handbook No. 1.01, Terror Operations: Case Studies in Terrorism 


23:00 


02:00 


03:15 


05:00 


11:00 


15:30 


Russian officials report 27 terrorists have been killed. 
September 4, 2004 


Ten explosions, similar to sound of hand grenades, occur at 
rear wing of school. 


Putin orders Beslan sealed and North Ossetia borders closed 
as security forces search for any remaining participants in 
Beslan mass murder 


Sporadic shooting in school area ceases. 


Russian officials list hostage death at more than 322 with 
155 deaths being children. (By following day, death report 
would rise to 355 deaths with 207 people identified. 386 
hospitalized people include 58 patients in critical medical 
condition.) 


Putin makes televised speech to nation that discusses 
terrorism, and issues of security and preparedness. 
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Source Notes 


The following source notes support illustrations used in Chapter 6, “Beslan: Hostage 
Crisis and Mass Murder.” to TRADOC G2 Handbook No.1.01. 


Figure 6-1. Beslan Hostage Crisis and Mass Murder by Terrorists A photomontage of Beslan: (Above, 
Upper Left) Grieving Woman, (Source: http://sinealdgleeson.com/blog/wp-images/beslan.jpg); (Above, 
Upper Middle) Beslan Boy After the Explosion, (Source: http//:www.salvator.net/salami.net/ 
salami/chronik/2004/beslan.jpg); (Above, Upper Right) Basayev the Terrorist, (Source: http://forum.zgeek. 
com/_gallery/ files/1/0/8/baseyev_thumb.jpg); (Above, Mid-Upper Right) Khochbarov the Terrorist; 
(Source: kavkazneo.com/art/khochbarov-1.jpg); (Right, Lower-Right) Adult After the Final Assault, 
(Source: http://news.bbc.co.ukmedia_images/40606000/jpg/_40606571_09_beslan_ap.jpg); (Right, 
Bottom) Security Force Soldier and Baby, (Source: http://emergency-management.net/school_); 
siege_imag.htm); (Above, Center) Security Forces and Civilians at Beslan, (Source: http://www.afp.com/ 
/english/afpwhatsnew/picture/imgs/Tutov2.jpg). 


Figure 6-2. Russian President Putin (Source: http;//www.businessinnovationinsider.com/ 
images/2006/04/Vladimir%20Putin.jpg). 


Figure 6-3. Above, Left Russian Caucasus and Area of Interest (box added) 
(Source: http://www.lib.utexas.edu/maps/commonwealth/chechnya_rel01.pdf). 


Figure 6-4. Above, Right North Ossetia and Beslan (outline added) 
(Source: http://www.globalsecurity.org/military/world/war/images/beslan-map2-s.jpg). 


Figure 6-5. Above, Left. Beslan Map (Out of Date) (box added) 
(Source: organizational files ). 


Figure 6-6. Above, Right. Beslan Overhead Image (outline added) 
(Source: http://www.directionsmag.com/images/newsletter/2004/09_08/beslan_school_sep4 2004 dg lIg.gif; and 
http://www. digitalglobe.com/images/gb/beslan_scholl_sep04_dg.jpg). 


Figure 6-7. Basayev (Source: http://forum.zgeek.com/gallery/files/1/0/8/baseyev_thumb.jpg). 
Figure 6-8. Khochbarov (Source: kavkazneo.com/art/khochbarov-1.jpg). 


Figure 6-13. Hostage Crisis and Murder at Beslan (Source: Above, Left 

http://www. guardian.co.uk/gallery/image/0,8543,-11905007821,00.html); (Source: Above, Center 
http://www. guardian.co.uk/gallery/image/0,8543,-12805007821,00.html); 

(Source: Above, Right http://content.answers.com/main/content/wp/en/0/0b/Beslan_School_ 
Terror_-_terrorist_4_- Sept_1, 2004.jpg); (Source: Above, Lower Left http://www. intelmessages.); 
org/images/beslandrugs.jpg); (Source: Lower Right http://www.spiegel.de/img/0,1020,387898,00.jpg) 


Figure 6-15. Hostages Escape as the Fight Continues (Source: Above, Left 
http://img154.imageshack.us/img154/5844/5844/screenay2ac8.jpg); (Source: Above, Center 
http://www.sullivan-county.com/images 1/beslan/beslan.html); (Source: Above, Right 
http://www. russned.ru/i/beslan.jpg). 


Figure 6-16. The Fighting Concludes and Aftermath (Source: Above, Left 
http://www. faithfreedom.org/forum/viewtopic.php?t=13967); (Source: Above, Center 
http://transformation.ru/nastka/files/beslan_0742.jpg); (Source: Above, Right 
english.chosun.com/.../200409070043_01.jpg); (Source: Above, Low Left 
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http://www. axisglobe.com/Image/2006/08/29/007/3.jpg); (Source: Above, Low Right 
http://www. faithfreedom.org/forum/viewtopic.php?t=13967). 


Figure 6-17. Recovery Efforts After the Fight (Source: Above, Center 
http://vip.lenta.ru/topic/beslan/48b.jpg); (Source: Above, Left http://www. yenisafak. 
com.tr/arsiv/2004/E YLUL/05/0510c.jpg) (Source: Above, Right www.cbc.ca/gfx/photos/ 
russiaschool_cp_6313321.jpg). 


Figure 6-18. Local Police Take Cover (Source: http://www .foxnews.com/photoessay/0,4644,141,00.htmH#13_0) 
Figure 6-19.Firefighters at Beslan (Source: http/Awww.ciisisresponsejoumal.com/images/beslan,jpg) 


Figure 6-20. Ad Hoc Casualty Evacuation (Source: http://www.emergency- 
management.net/school_siege_imag.htm) 


Figure 6-21. Domestic Terror Response (Source: Above, Right http://www.cityofconroe/police/ 
Objects/swat-stack-med.jpg); (Source: Above, Center www.newcriminologist.co.uk/.../untitled(8).bmp); 
(Source: Bottom http://(www.emergency.com/1999/co-anlys.htm). 


Figure 6-22. First Responders to Crisis: Police-Emergency Services-F BI (Source: Above, Top DOD 
Photo; 060608-F-1644L-015.jpg);(Source:Center, Left https://hseep. dhs.gov/HSEEP_Vols/HSEEP 
_Vol4%5...); (Source: Center http://www.army.mil/soldiers/sep2001/pentattack/images/emt.jpg); 
(Source:Center, Right http://www.sacrop.org/images/square%20emt.jpg; (Source: Bottom, Center 
denver.rockymountainnews.com/.../1212swat.jpg). 
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Glossary 


Aleph: name of former cult Aum Shinrikyo; cult renamed itself in January 2000. 
Ammonium nitrate fertilizer: chemical mixture that can be used in manufacture of improvised explosive. 


anarchism: A political theory holding all forms of governmental authority to be unnecessary and 
undesirable and advocating a society based on voluntary cooperation and free association of individuals 
and groups. (Webster’s) 


anti-terrorism: (AT) (JP 1-02) Defensive measures used to reduce the vulnerability of individuals and 
property to terrorist acts, to include limited response and containment by local military forces. 


AOR: Area of responsibility 
ATF: U.S. Federal Bureau of Alcohol, tobacco, and Firearms. 
Aum Shinrikyo: Cult responsible for the 1995 sarin attack on population in the Tokyo subway system. 


biological agent: (JP 1-02) A microorganism that causes disease in personnel, plants, or animals or causes 
the deterioration of materiel. 


biological weapon: (JP 1-02) An item of materiel, which projects, disperses, or disseminates a biological 
agent including arthropod vectors. 


bioregulators: (CBRN Handbook) Biochemicals that regulate bodily functions. Bioregulators that are 
produced by the body are termed "endogenous." Some of these same bioregulators can be chemically 
synthesized. 


blister agents: (CBRN Handbook) Substances that cause blistering of the skin. Exposure is through liquid 
or vapor contact with any exposed tissue (eyes, skin, lungs). 


blood agents: (CBRN Handbook) Substances that injure a person by interfering with cell respiration (the 
exchange of oxygen and carbon dioxide between blood and tissues). 


CBRNE: Chemical, biological, radiological, nuclear, and high yield explosive categories normally 
associated with weapons of mass destruction. 


chemical weapon: (JP 1-02) Together or separately, (a) a toxic chemical and its precursors, except when 
intended for a purpose not prohibited under the Chemical Weapons Convention; (b) a munition or 
device, specifically designed to cause death or other harm through toxic properties of those chemicals 
specified in (a), above, which would be released as a result of the employment of such munition or 
device; (c) any equipment specifically designed for use directly in connection with the employment of 
munitions or devices specified in (b) above. 


chemical agent: (CBRN Handbook) A chemical substance that is intended for use in military operations to 
kill, seriously injure, or incapacitate people through its physiological effects. Excluded from 
consideration are riot control agents, and smoke and flame materials. The agent may appear as a vapor, 
aerosol, or liquid; it can be either a casualty/toxic agent or an incapacitating agent. 


choking agents: (CBRN Handbook) Substances that cause physical injury to the lungs. Exposure is 


through inhalation. In extreme cases, membranes swell and lungs become filled with liquid. Death 
results from lack of oxygen; hence, the victim is "choked." 
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conflict: (Army) A political-military situation between peace and war, distinguished from peace by the 
introduction of organized political violence and from war by its reliance on political methods. It shares 
many of the goals and characteristics of war, including the destruction of governments and the control 
of territory. See FM 100-20. 


COCOM: Combatant command, that is, command authority. See page 247 footnote of handbook. (JP 1-02) 


consequence management: Traditionally, consequence management has been predominantly an 
emergency management function and included measures to protect public health and safety, restore 
essential government services, and provide emergency relief to governments, businesses, and individuals 
affected by the consequences of terrorism. The requirements of consequence management and crisis management are 
combined in the NRP. 


CONUS: Continental United States 
counter-terrorism: (CT) (JP 1-02) Offensive measures taken to prevent, deter, and respond to terrorism. 


crisis management: Traditionally, crisis management was predominantly a law enforcement function and 
included measures to identify, acquire, and plan the use of resources needed to anticipate, prevent, 
and/or resolve a threat or act of terrorism. The requirements of consequence management and crisis 
management are combined in the NRP. 


Cult: A quasi-religious group, often living in a colony, with a charismatic leader who indoctrinates 
members with unorthodox or extremist views. (Webster’s New World Dictionary of American English) 


cyber-terrorism: (FBI) — A criminal act perpetrated by the use of computers and telecommunications 
capabilities, resulting in violence, destruction and/or disruption of services to create fear by causing 
confusion and uncertainty within a given population, with the goal of influencing a government or 
population to conform to a particular political, social, or ideological agenda. 


DSWA: Defense Special Weapons Agency 


Defense Support of Civil Authorities: (DSCA) An emergent term under consideration for inclusion to the 
2004 National Response Plan that incorporates the Department of Defense support to domestic 
emergencies, law enforcement, and other activities. A traditional overarching term is Military 
Assistance to Civil Authorities (MACA) which includes Military Support to Civil Authorities (MSCA) 
and Military Assistance to Law Enforcement Agencies (MACLEA). See NRP. 


Designated Foreign Terrorist Organization: (DFTO) A political designation determined by the U.S. 
Department of State. Listing as a DFTO imposes legal penalties for membership, prevents travel into 
the U.S., and proscribes assistance and funding activities within the U.S. or by US. citizens. 

DIRLAUTH: Direct liaison authorized 


DHS: Department of Homeland Security 


dysfunctional state: A nation or state whose declared government cannot fulfill one or more of the core 
functions of governance, such as defense, internal security, revenue collection, resource allocation, etc. 


failed state: A dysfunctional state which also has multiple competing political factions in conflict within 
its borders, or has no functioning governance above the local level. This does not imply that a central 
government facing an insurgency is automatically a failed state. If essential functions of government 
continue in areas controlled by the central authority, it has not “failed.” 


force protection: Security program designed to protect Service members, civilian employees, family 
members, facilities, and equipment, in all locations and situations, accomplished through planned and 
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integrated application of combating terrorism, physical security, operations security, personal protective 
services, and supported by intelligence, counterintelligence, and other security programs. 


force protection condition (FPCON): There is a graduated series of Force Protection Conditions ranging 
from Force Protection Conditions Normal to Force Protection Conditions Delta. There is a process by 
which commanders at all levels can raise or lower the Force Protection Conditions based on local 
conditions, specific threat information and/or guidance from higher headquarters. The four Force 
Protection Conditions above normal are: 


Force Protection Condition ALPHA--This condition applies when there is a general threat of possible 
terrorist activity against personnel and facilities, the nature and extent 
of which are unpredictable, and circumstances do not justify full implementation of Force Protection 
Conditions BRAVO measures. The measures in this Force Protection Conditions must be capable of 
being maintained indefinitely. 


Force Protection Condition BRAVO--This condition applies when an increased and more predictable 
threat of terrorist activity exists. The measures in this Force Protection Conditions must be capable of 
being maintained for weeks without causing undue hardship, affecting operational capability, and 
aggravating relations with local authorities. 


Force Protection Condition CHARLIE--This condition applies when an incident occurs or intelligence is 
received indicating some form of terrorist action against personnel and facilities is imminent. 
Implementation of measures in this Force Protection Conditions for more than a short period probably 
will create hardship and affect the peacetime activities of the unit and its personnel. 


Force Protection Condition DELTA--This condition applies in the immediate area where a terrorist attack 
has occurred or when intelligence has been received that terrorist action against a specific location or person is 
likely. Normally, this Force Protection Conditions is declared as a localized condition. 


guerrilla warfare: (JP 1-02, NATO) Military and paramilitary operations conducted in enemy-held or hostile 
territory by irregular, predominantly indigenous forces. 


WOT: Global War on Terrorism 


Homeland Security Advisory System (HSAS): The advisory system provides measures to remain 
vigilant, prepared, and ready to deter terrorist attacks. The following Threat Conditions each represent 
an increasing risk of terrorist attacks. Beneath each Threat Condition are suggested protective 
measures, recognizing that the heads of Federal departments and agencies are responsible for 
developing and implementing appropriate agency-specific protective measures: 


e Low Condition (Green). This condition is declared when there is a low risk of terrorist 
attacks. Federal departments and agencies should consider the following general measures in 
addition to the agency-specific Protective Measures they develop and implement: refining and 
exercising as appropriate preplanned Protective Measures; ensuring personnel receive proper 
training on the Homeland Security Advisory System and specific preplanned department or 
agency Protective Measures; and institutionalizing a process to assure that all facilities and 
regulated sectors are regularly assessed for vulnerabilities to terrorist attacks, and all 
reasonable measures are taken to mitigate these vulnerabilities. 


e Guarded Condition (Blue). This condition is declared when there is a general risk of terrorist 
attacks. In addition to the Protective Measures taken in the previous Threat Condition, Federal 
departments and agencies should consider the following general measures in addition to the 
agency-specific Protective Measures that they will develop and implement: checking 
communications with designated emergency response or command locations; reviewing and 
updating emergency response procedures; and providing the public with any information 
that would strengthen its ability to act appropriately. 
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e Elevated Condition (Yellow). An Elevated Condition is declared when there is a significant 
risk of terrorist attacks. In addition to the Protective Measures taken in the previous Threat 
Conditions, Federal departments and agencies should consider the following general measures 
in addition to the Protective Measures that they will develop and implement: increasing 
surveillance of critical locations; coordinating emergency plans as appropriate with nearby 
jurisdictions; assessing whether the precise characteristics of the threat require the further 
refinement of preplanned Protective Measures; and implementing, as appropriate, contingency 
and emergency response plans. 


e High Condition (Orange). A High Condition is declared when there is a high risk of terrorist 
attacks. In addition to the Protective Measures taken in the previous Threat Conditions, 
Federal departments and agencies should consider the following general measures in addition 
to the agency-specific Protective Measures that they will develop and implement: 
coordinating necessary security efforts with Federal, State, and local law enforcement 
agencies or any National Guard or other appropriate armed forces organizations; taking 
additional precautions at public events and possibly considering alternative venues or even 
cancellation; preparing to execute contingency procedures, such as moving to an alternate site 
or dispersing their workforce; and restricting threatened facility access to essential personnel 
only. 


e Severe Condition (Red). A Severe Condition reflects a severe risk of terrorist attacks. Under 
most circumstances, the Protective Measures for a Severe Condition are not intended to be 
sustained for substantial periods of time. In addition to the Protective Measures in the 
previous Threat Conditions, Federal departments and agencies also should consider the 
following general measures in addition to the agency-specific Protective Measures that they 
will develop and implement: increasing or redirecting personnel to address critical emergency 
needs; signing emergency response personnel and pre-positioning and mobilizing specially 
trained teams or resources; monitoring, redirecting, or constraining transportation systems; 
and closing public and government facilities. 


HUMINT: Human intelligence 


IED: Improvised Explosive Device. Devices that have been fabricated in an improvised manner and 
that incorporate explosives or destructive, lethal, noxious, pyrotechnic, or incendiary chemicals 
in their design. 


incapacitating agent: (CBRN Handbook) Produce temporary physiological and/or mental effects via 
action on the central nervous system. Effects may persist for hours or days, but victims usually do not 
require medical treatment. However, such treatment speeds recovery. 


Incident Command System (ICS): A standardized on-scene emergency management concept specifically 
designed to allow its user(s) to adopt an integrated organizational structure equal to the complexity and 
demands of single or multiple incidents without being hindered by jurisdictional boundaries. The 
national standard for ICS is provided by NIMS. 


industrial agent: (CBRN Handbook) Chemicals developed or manufactured for use in industrial 
operations or research by industry, government, or academia. These chemicals are not primarily 
manufactured for the specific purpose of producing human casualties or rendering equipment, facilities, 
or areas dangerous for use by man. Hydrogen cyanide, cyanogen chloride, phosgene, chloropicrin and 
many herbicides and pesticides are industrial chemicals that also can be chemical agents. 


insurgency: (JP 1-02, NATO) — An organized movement aimed at the overthrow of a constituted 
government through the use of subversion and armed conflict. 
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international: of, relating to, or affecting two or more nations (Webster’s). For our purposes, affecting two 
or more nations. 


JSDF: Japanaese Self Defense Force [military forces]. 


Khobar Towers: Site of 1996 terrorist bombing attack on U.S. and coalition forces in Dhahran, Saudi 
Arabia by the terrorist group Saudi Hizballah, a la Hizballah Al-Hijaz. 


LFA: Lead Federal Agency. See NRP. 
Matsumoto: site in Japan of 1994 sarin attack by the Aum Shinrikyo cult. 


McVeigh: First name Timothy; convicted and executed U.S. domestic terrorist/bomber of Murrah Federal 
Building in Oklahoma City, OK. 


millenarian: Apocalyptic; forecasting the ultimate destiny of the world; foreboding imminent disaster or 
final doom; wildly unrestrained; ultimately decisive. (Merriam —Webster’s) 


Murrah Building: Alfred P. Murrah Federal Building; site of 1995 Oklahoma City bombing. 


narco-terrorism: (JP 3-07.4) Terrorism conducted to further the aims of drug traffickers. It may include 
assassinations, extortion, hijackings, bombings, and kidnappings directed against judges, prosecutors, 
elected officials, or law enforcement agents, and general disruption of a legitimate government to divert 
attention from drug operations. 


nation: A community of people composed of one or more nationalities and possessing a more or less 
defined territory and government or a territorial division containing a body of people of one or more 
nationalities and usually characterized by relatively large size and independent status. 


nation-state: A form of political organization under which a relatively homogeneous people inhabits a 
sovereign state; especially a state containing one as opposed to several nationalities. 


nerve agents: (CBRN Handbook) Substances that interfere with the central nervous system. Exposure is 
primarily through contact with the liquid (skin and eyes) and secondarily through inhalation of the 
vapor. Three distinct symptoms associated with nerve agents are: pin-point pupils, an extreme headache, 
and severe tightness in the chest. 


National Incident Management System: (NIMS). See National Incident Management System published 
by the Department of Homeland Security, 1 March 2004. The NIMS represents a core set of doctrine, 
concepts, principles, technology and organizational processes to enable effective, efficient, and 
collaborative incident management. Nationwide context is an all-hazards, all jurisdictional levels, and 
multi-disciplines approach to incident management. 


National Response Plan: (NRP) The National Response Plan (December 2004) is an all-discipline, all- 
hazards plan that establishes a single, comprehensive framework for the management of domestic 
incidents. It provides the structure and mechanisms for the coordination of Federal support to State, 
local, and tribal incident managers and for exercising direct Federal authorities ad responsibilities. 


Nichols: First Name Terry; convicted for involvement with Timothy McVeigh in 1995 bombing of Murrah 
Federal Building. 


nuclear weapon: (JP 1-02) — A complete assembly (i.e., implosion type, gun type, or thermonuclear 


type), in its intended ultimate configuration which, upon completion of the prescribed arming, fusing, 
and firing sequence, is capable of producing the intended nuclear reaction and release of energy. 
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OPCON: Operational control, that is, transferable command authority. See Appendix H of terrorism 
handbook. (JP 1-02). 


operations security: (OPSEC) A process of identifying critical information and subsequently analyzing 
friendly actions attendant to military operations and other activities to: a. Identify those actions that can 
be observed by adversary intelligence systems. b. Determine indicators hostile intelligence systems 
might obtain that could be interpreted or pieced together to derive critical information in time to be 
useful to adversaries. c. Select and execute measures that eliminate or reduce to an acceptable level the 
vulnerabilities of friendly actions to adversary exploitation. Also called OPSEC. (Joint Pub 1-02) 


Pathogen: (CBRN Handbook) Any organism (usually living) capable of producing serious disease or 
death, such as bacteria, fungi, and viruses 


physical security: That part of security concerned with physical measures designed to safeguard personnel; 
to prevent unauthorized access to equipment, installations, material and documents; and to safeguard 
them against espionage, sabotage, damage, and theft. (Joint Pub1-02) 


Radiological Dispersal Device: (RDD) (CBRN Handbook) A device (weapon or equipment), other than a 
nuclear explosive device, designed to disseminate radioactive material in order to cause destruction, 
damage, or injury by means of the radiation produced by the decay of such material. 


Radiological Emitting Device: (RED) A device designed to disseminate radioactive material in order to 
cause destruction, damage, or injury by means of the radiation produced by the decay of such material. 
RED dissemination techniques can include intense, short duration exposure or progressive, long term 
exposure to radiation. 


radiological operation: (JP 1-02) — The employment of radioactive materials or radiation producing 
devices to cause casualties or restrict the use of terrain. It includes the intentional employment of fallout 
from nuclear weapons. 

Ruby Ridge: Site of 1992 incident between U.S. citizens and Federal agents. 


sarin: a colorless, odorless, tasteless, human-made chemical warfare agent. 


setback: Distance between outer perimeter and nearest point of buildings or structures within. Generally 
referred to in terms of explosive blast mitigation. 


Shoko Asahara; Self-named leader of the cult Aum Shinrikyo; convited of ordering the 1995 sarin attack 
on the population in the Tokyo subway system. 


state: A politically organized body of people usually occupying a definite territory; especially one 
that is sovereign. 


TACON: Tactical control, that is, command authority with detailed limitations and responsibilities inherent 
to operational control. See Appendix H of terrorism handbook. (JP 1-02). 


terror tactics: Given that the Army defines tactics as “the art and science of employing available means to 
win battles and engagements,” then terror tactics should be considered “the art and science of 
employing violence, terror and intimidation to inculcate fear in the pursuit of political, religious, or 
ideological goals.” 


terrorism: (JP 1-02) — The calculated use of violence or threat of violence to inculcate fear; intended to 
coerce or to intimidate governments or societies in the pursuit of goals that are generally political, 


religious, or ideological. 


terrorist: (JP 1-02) — An individual who uses violence, terror, and intimidation to achieve a result. 
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terrorist goals: The term goals will refer to the strategic end or end state that the terrorist objectives are 
intended to obtain. 


terrorist group: Any group practicing, or that has significant subgroups that practice, international 
terrorism (U.S. Dept of State) 


terrorist objectives: The standard definition of objective is — “The clearly defined, decisive, and attainable 
aims which every military operation should be directed towards” (JP 1-02). For the purposes of this 
work, terrorist objectives will refer to the intended outcome or result of one or a series of terrorist 
operations or actions. 


toxic chemical agent: (CBRN Handbook) Produce incapacitation, serious injury, or death. They can be 
used to incapacitate or kill victims. These agents are the choking, blister, nerve, and blood agents. 


toxin agent: (JP 1-02) A poison formed as a specific secretion product in the metabolism of a vegetable or 
animal organism, as distinguished from inorganic poisons. Such poisons can also be manufactured by 
synthetic processes. 


transnational: Extending or going beyond national boundaries (Webster’s). In this context, not limited to 
or centered within a single nation. 


underground: A covert unconventional warfare organization established to operate in areas denied to the 
guerrilla forces or conduct operations not suitable for guerrilla forces. 


unified command: As a term in the Federal application of the Incident Command System (ICS), defines 
agencies working together through their designated Incident Commanders at a single Incident 
Command Post (ICP) to establish a common set of objectives and strategies, and a single Incident 
Action Plan. This is NOT “unified command” as defined by the Department of Defense. 


UXO: Unexploded ordnance 

VBIED: Vehicle borne improvised explosive device 

Waco: Site of 1993 incident between U.S. citizens of the Branch Davidian cult and Federal agents. 

WOT: War on Terrorism 

WMD: (JP 1-02) Weapons of Mass Destruction. Weapons that are capable of a high order of destruction 
and/or of being used in such a manner as to destroy large numbers of people. Weapons of mass 
destruction can be high explosives or nuclear, biological, chemical, and radiological weapons, but 
exclude the means of transporting or propelling the weapon where such means is a separable and 
divisible part of the weapon. 

WMD: Weapons of mass destruction or effect is an emergent term referenced in the 2004 U.S. National 


Military Strategy to address a broader range of adversary capabilities with potentially devastating 
results. 
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